Metadata file not written to /sp/metadata when testing Jans SAML SSO

[zackbum]

Hi,

I am using Jans server version 1.1.5 with opendj LDAP. I have post-installed jans-kc and I can login to Keycloak admin GUI vi web interface. I have tried to test SAML SSO using iamshowcase and downloaded testsp_metadata.xml via command:

wget https://sptest.iamshowcase.com/testsp_metadata.xml

In Jans TUI I have configured IDP and after saving the link to metadata xml was shown:
/opt/idp/configs/keycloak/sp/metadata/2b634a1b-de53-4383-965b-d5ee8ee5e4c0_sp-metadata.xml

If I look into that folder the folder is empty. Using command

grep -ir error

I could get following error messages from jetty logs:
025_06_17.jetty.log:17-06 07:36:49.808 ERROR saml.common.xml.SAMLSchemaBuilder SAMLSchemaBuilder.java:255- Failed to locate schema resource: /schema/soap-envelope.xsd
2025_06_17.jetty.log:17-06 07:36:49.816 ERROR document.store.provider.DBDocumentStoreProvider DBDocumentStoreProvider.java:171- Document file '/opt/idp/configs/keycloak/sp/metadata/2b634a1b-de53-4383-965b-d5ee8ee5e4c0_sp-metadata.xml' isn't empty

Any suggestions why file 2b634a1b-de53-4383-965b-d5ee8ee5e4c0_sp-metadata.xml is not written to folder shown in Jans Saml?

Thanks

[nynymike]

@uprightech and @manojs1978 ... can you check?

[manojs1978]

Hello @zackbum ,
in v1.1.5 with ldap, it is not working but we are not supporting LDAP any more.
could you please check it in nightly build or latest release

[zackbum]

Hi @nynymike, @manojs1978,

I know that you are not supporting LDAP for Jans Server but it is currently not an option for me to switch to postgres or mysql database or a newer Jans server version. I do not believe that Jans_Saml is not working with LDAP as Keycloak can handle LDAP databases. I do not have currently done any configuration in Keycloak but I saw that there is a Janssen Realm and a custom jans-user-federation which might need some adaptions to run with opendj LDAP. Please provide some hints on how to edit jans-user-federation. In addition, I had changed the opendj certificates to "real" certificates from a trusted CA which also need to be configured in Keycloak to get access. Of course I can read through all the Keycloak documentations but you are the experts. Any suggestions to go further are welcome.

Thanks

[manojs1978]

@uprightech could you please have look

[zackbum]

Hi @uprightech,
I have used the kc-saml-plugin from version 1.4.0 and Jans tui throws the below error when saving saml configuration:

2025_06_23.jetty.log:23-06 15:19:56.545 ERROR document.store.service.DBDocumentService DBDocumentService.java:93- Not able to find the document. Here is the exception message
2025_06_23.jetty.log:23-06 15:20:03.444 ERROR document.store.provider.LocalDocumentStoreProvider LocalDocumentStoreProvider.java:176- Failed to read document as stream from file '/null'
2025_06_23.jetty.log:org.jboss.resteasy.spi.UnhandledException: java.lang.NoSuchMethodError: 'java.lang.String io.jans.service.document.store.service.LocalDocumentStoreService.saveDocumentStream(java.lang.String, java.lang.String, java.io.InputStream, java.lang.String)'
2025_06_23.jetty.log:java.lang.NoSuchMethodError: 'java.lang.String io.jans.service.document.store.service.LocalDocumentStoreService.saveDocumentStream(java.lang.String, java.lang.String, java.io.InputStream, java.lang.String)'

I assume that even if all dependencies are provided in the plugin the Java class loader gets the wrong version of the same class. If you do not have a quick solution, I will stop here and try to use the version 1.8.0.

Thanks

[ossdhaval]

I vote for moving to 1.8.0. 🗳️

[uprightech]

Same here.

[zackbum]

Hi @nynymike @uprightech @ossdhaval,

I finally fixed this issue for Jans 1.1.5. Here are the steps I have done:

1. Copy complete jans-config-api folder from version 1.1.5 source code to a new folder
2. Search for SamlIdpService.java and update code with code from SamlIdpService.java in the source code of version 1.8.0
3. Save SamlIdpService.java file and compile folder kc-saml-plugin in the jans-config-api folder against maven and available pom file using command >: mvn clean install
4. Ignore test errors and grab SamlIdpService.class file from newly created target folder.
5. Patch file kc-saml-plugin.jar from existing version 1.1.5 installation with the SamlIdpService.class file using command >: zip -ur io/...
6. Reboot jans server
7. Perform Saml SP test
8. Now metadata xml file is written to folder /opt/idp/configs/keycloak/sp/metadata
9. In ldap there is a trustrelationship entry for iamshowcase
10. SP test was performed without errors

[uprightech]

This looks okay. Although we will still recommend an upgrade as it's a solution that scales better. In this, case it worked because no relevant dependency changes were introduced by the changes to SamlIdpService.class. But we're glad it worked out well.

[zackbum]

Hi @uprightech @nynymike

If you do a 1 to 1 copy of the SamlIdpService.java from version 1.8.0 to 1.1.5 it will not compile. Thus, you need to understand the code and the code of the fix. Only some snippets of code need to be updated for version 1.1.5 as this SamlIdpService.java is dependent on org.apache.commons-lang and the SamlIdpService.jave of version 1.8.0 on org.apache.commons-lang3. That's the trick :)

[nynymike]

@uprightech , please review.