Date parsing issue?

classic Classic list List threaded Threaded
4 messages Options
Reply | Threaded
Open this post in threaded view
|

Date parsing issue?

Brian Biggs-2
Hi,

We have a password nearing expiration intercept flow configured, which
has been working fine for a couple of months.

Last night, for only 1 hour (between 6pm and 7pm PST), our IDP generated
the following error:

2019-02-07 18:00:02,409 - 130.157.xxx.xxx - INFO
[net.shibboleth.idp.profile.logic.DateAttributePredicate:164] -
2019-03-10T02:00:02Z is not a valid date for the configured date parser

I tracked it back to the intercept flow.

The relevant config is:

<bean
   id="shibboleth.expiring-password.Condition"
   class="net.shibboleth.idp.profile.logic.DateAttributePredicate"
   c:attribute="passwordExpiration"
   c:formatString="yyyy'-'MM'-'dd'T'HH':'mm':'ss'Z'"
   p:resultIfMissing="false" p:offset="-P10D" />

Am I missing something here or does the date in the error match the
formatString in the config bean? Is the formatString wrong?

Could this be due to switching from OracleJDK to OpenJDK?

Any insight here would be appreciated.

Thanks,
-Brian

--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to [hidden email]
Reply | Threaded
Open this post in threaded view
|

Re: Date parsing issue?

Cantor, Scott E.
On 2/8/19, 10:17 AM, "users on behalf of Brian Biggs" <[hidden email] on behalf of [hidden email]> wrote:

> Am I missing something here or does the date in the error match the
> formatString in the config bean? Is the formatString wrong?

No way to know, the logging wasn't recording the exception for whatever reason so I just patched it.

> Could this be due to switching from OracleJDK to OpenJDK?

My hatred of OpenJDK is long standing and something I'm going to have to get over but that seems very unlikely. My guess is you had a hidden character in the data.
 
-- Scott


--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to [hidden email]
Reply | Threaded
Open this post in threaded view
|

Re: Date parsing issue?

Phil Pishioneri
In reply to this post by Brian Biggs-2
On 2019/2/8 10:16 AM, Brian Biggs wrote:
> We have a password nearing expiration intercept flow configured, which
> has been working fine for a couple of months.
>
> Last night, for only 1 hour (between 6pm and 7pm PST), our IDP
> generated the following error:
>
> 2019-02-07 18:00:02,409 - 130.157.xxx.xxx - INFO
> [net.shibboleth.idp.profile.logic.DateAttributePredicate:164] -
> 2019-03-10T02:00:02Z is not a valid date for the configured date parser


If that timestamp had been in your local time zone, it would be invalid
due to the Daylight Saving Time change on March 10 (no 02:mm hour that
morning). But to me the 'Z' should put it outside that hour. (Maybe
there's a missing time zone offset in the output?)

The time frame you mentioned (6pm-7pm PST) with an 8 hour offset from
UTC would map to 0200-0300 UTC.

-Phil

--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to [hidden email]
Reply | Threaded
Open this post in threaded view
|

Re: Date parsing issue?

Cantor, Scott E.
On 2/8/19, 11:06 AM, "users on behalf of Phil Pishioneri" <[hidden email] on behalf of [hidden email]> wrote:

> If that timestamp had been in your local time zone, it would be invalid
> due to the Daylight Saving Time change on March 10 (no 02:mm hour that
> morning). But to me the 'Z' should put it outside that hour. (Maybe
> there's a missing time zone offset in the output?)

That probably means it's a bug in the way the date is being handled. I don't think it's treating the Z as an indicator of the time zone being UTC, it's just parsing it out as a literal to ignore. I don't expect that bug to get fixed but filing it may be a prod to make sure the bug isn't repeated when the code is converted off of joda-time to Java's classes.

-- Scott


--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to [hidden email]