SSO after Update 3 - Please help

[Pete220652393l9r]

Hello Community - need help badly as I am more of a infrastructure person then coder  

We were in the process of setting up SSO with Azure as the identity provider - 

we had  it working with the simplest of code:  (basically from the Adobe help page)

<cfset config = {

idp = {name = "ptestidp"},

sp = {name = "testsp"},

relayState = "cart"

}>

<cfset InitSAMLAuthRequest(config)>

since the update I get the following -  line 11 being the call to initialize the azure call 

Error Occurred: 12/20/2021 07:48:07 PM
     Error Type: java.lang.NullPointerException
     Error Message:
     Error Detail:
     Template: E:\internal\betahost.mycompany.com\pindex.cfm
     Line: 11
     Column: 0

[Charlie Arehart]

It seems you're presuming update 3 broke your sso. If you were on update 2, that won't make sense. The only change is about log4j.

So I would propose instead that your problem could be instead about an error having occurred during the update. Those can EASILY happen. For more, see my post:

https://coldfusion.adobe.com/2019/03/problems-applying-cf-update-check-first/

Please let us know what you find. 

[BKBK]

...

<cfset InitSAMLAuthRequest(config)>

since the update I get the following -  line 11 being the call to initialize the azure call 

Error Occurred: 12/20/2021 07:48:07 PM
     Error Type: java.lang.NullPointerException
 ...

By @Pete220652393l9r

The exception suggests that InitSAML is null. Hence the error occurred where InitSAML was evaluated. That is, before line 11.

Go back there and have a look. If you still have questions it will certainly help to share that part of the code with the forum.

[Pete220652393l9r]

Thank you for the reply - 

So I read your blogs - and followed the manual install instructions.

I shut down all the CF services.

I shut down IIS

I had to uninstall the update (3)  first - because when I went to invoke the jar via the command line - the installer started just like you said - but it detected it was already installed and there were no further options - so I started everything back up and uninstalled via the web interface - 

I went through the steps again, installed the patch manually, and started up IIS first, then the CF services. And everything worked - SSO was initialized, and I was brought to the homepage. 

Come the morning when a developer tells me they can't access the sftp service -  A restart of the OpenSSH service failed, so I rebooted the box - and then and there that's when sso broke again.

I plan on dancing with the box tonight and will dissect the patch and verify file versions and such.  Reinstall and reboot and test. Probably something out of sorts on that server. Any guidance is always appreciative.

pete

[Charlie Arehart]

Thanks for all the clarifications. I'd ask now what jvm version you are running. See the cf admin settings summary page, and it's report of the jvm version. (Don't trust any other report or presumption.) 

If it's 11.0.1, the jvm that came with the original cf2021 installer, update it to at least 11.0.10, and tell us how things go.

If you want to go to (or are already at) 11.0.11 or above, beware that if the sso site you're calling is not running tls 1.2 or greater, these later Java versions restrict Java tls calling to that by default. That can be fixed. See a blog post I did in April (when 11.0.11 came out), or the Java technotes for that. Or I can help directly. 

[Pete220652393l9r]

First off Charlie  thank you very much for taking your time to help.

I upgraded the JVM as you suggested without issue.  I upgraded to 11.0.12

As of now everything is working.

Pete

What is recommended JVM version to be on?

What's the best practice in upgrading it? 

[Charlie Arehart · Accepted solution]

Good to hear, but I know you said the success had been off and on, so time will tell now. The latest jvm currently (that Cf supports) is 11.0.13. Adobe always supports you being on the latest jvm update  of whatever jvm version is supported by your cf version. Cf 2021 currently supports only Java 12. (I have a blog post with a table of Java versions supported by cf versions.)

As for best practices, there are, of course. I know of no single resources listing them. I have a post with the reverse: common mistakes people make in updating the jvm, and how to solve those.

Maybe during this holiday season I could pull together such a best practices post. Until then, hope the above helps.