Policy Server installer does not recognize JRE 11.0.20

Products

SITEMINDER CA Single Sign-On

Issue/Introduction

Policy Server R12.8.7 installer is not recognizing JRE 11.0.20 and higher and reports "Invalid JRE Path".

Operating System: Red Hat Linux and Windows

Java: Oracle or Adopt OpenJDK 11.0.20 or newer (versions prior to this are unaffected)

- Red Hat Linux Error:

- Windows Error:

Environment

Release : 12.8.07 release

Component: CA Siteminder Policy Server (SMPLC)

OS: All Supported Operating Systems (Windows, Red Hat)

Cause

This is due to changes in the Java release 11.0.20.

JDK 11.0.20 Release Notes

core-libs/java.util.jar
➜ Improved ZIP64 Extra Field Validation (JDK-8302483 (not public))
java.util.zip.ZipFile has been updated to provide additional validation of ZIP64 extra fields when opening a ZIP file. This validation may be disabled by setting the system property jdk.util.zip.disableZip64ExtraFieldValidation to true

Installer Output with Java 11.0.19 (working):

Installer Output with Java 11.0.20(not working):

JAVACHECK_EXECUTE_STDOUT -

Selected Java architecture : 64
Selected Java Vendor : Eclipse Adoptium
Selected Java version : 11.0.19

JAVACHECK_EXECUTE_STDERR - ADOPT_OPEN_JDK|SM|64|SM|11.0.19|SM|
JAVACHECK_EXECUTE_EXITCODE - 0

prop.java.class.path - /tmp/install.dir.12059/InstallerData:/tmp/install.dir.12059/InstallerData/installer.zip:
IA_USER_DIR - /tmp/install.dir.12059

----------------------------
ADOPT_OPEN_JDK|SM|64|SM|11.0.19|SM|
----------------------------
----------------------------
3
[ADOPT_OPEN_JDK, 64, 11.0.19]
----------------------------
Selected JDK details

CHOSEN_JDK_ROOT - < jdk-11.0.19+7-jre_root directory>

IS_SELECTED_64_BIT - true

IS_SELECTED_JAVA_11 - true

IS_SELECTED_JAVA_1DOT8 - false

IS_ADOPT_OPEN_JDK - true

IS_ORACLE_JDK - false

SELECTED_JAVA_VERSION - 11.0.19

USER_MAGIC_FOLDER_1=
CC_DIR=
SSO_INSTALL_EXIST =
EXISTING_VERSION =
EXISTING_LOCATION =
--------------------------------------------------------------

JAVACHECK_EXECUTE_STDOUT -
JAVACHECK_EXECUTE_STDERR - Error: Could not find or load main class com.netegrity.brlib.customcode.GetJavaDetails
Caused by: java.lang.ClassNotFoundException: com.netegrity.brlib.customcode.GetJavaDetails

JAVACHECK_EXECUTE_EXITCODE - 1

prop.java.class.path - /tmp/install.dir.12059/InstallerData:/tmp/install.dir.12059/InstallerData/installer.zip:
IA_USER_DIR - /tmp/install.dir.12059

----------------------------
Error: Could not find or load main class com.netegrity.brlib.customcode.GetJavaDetails
Caused by: java.lang.ClassNotFoundException: com.netegrity.brlib.customcode.GetJavaDetails

----------------------------
----------------------------
1
[Error: Could not find or load main class com.netegrity.brlib.customcode.GetJavaDetails
Caused by: java.lang.ClassNotFoundException: com.netegrity.brlib.customcode.GetJavaDetails
]
----------------------------
Selected JDK details

CHOSEN_JDK_ROOT - < jdk-11.0.20+8-jre_root_directory>

IS_SELECTED_64_BIT - false

IS_SELECTED_JAVA_11 - false

IS_SELECTED_JAVA_1DOT8 - false

IS_ADOPT_OPEN_JDK - false

IS_ORACLE_JDK - false

SELECTED_JAVA_VERSION -

*** LogExceptionIAWrapper ***
CC_KEY: 1006
CC_DEFAULT: Command failed: {0}\nReturn Value: {1}\nStdout: {2}\nStderr: {3}
CC_PARAM: "< jdk-11.0.20+8-jre_root_directory>/bin/java" -classpath "/tmp/install.dir.12059/InstallerData:/tmp/install.dir.12059/InstallerData/installer.zip:" com.netegrity.brlib.customcode.GetJavaDetails,,Error: Could not find or load main class com.netegrity.brlib.customcode.GetJavaDetails
Caused by: java.lang.ClassNotFoundException: com.netegrity.brlib.customcode.GetJavaDetails

*****************************
InstallExceptionHandler: formatted message=Command failed: "< jdk-11.0.20+8-jre_root_directory>/bin/java" -classpath "/tmp/install.dir.12059/InstallerData:/tmp/install.dir.12059/InstallerData/installer.zip:" com.netegrity.brlib.customcode.GetJavaDetails\nReturn Value: Error: Could not find or load main class com.netegrity.brlib.customcode.GetJavaDetails
Caused by: java.lang.ClassNotFoundException: com.netegrity.brlib.customcode.GetJavaDetails
\nStdout: {2}\nStderr: {3}
Writing to log file:
*****The architecture of the Enhanced Session Assurance with DeviceDNA feature is updated in Policy Server 12.6. This feature requires CA Access Gateway 12.6 or later. For information about using the feature, see the Configure Enhanced Session Assurance with DeviceDNA section in the documentation.
Command failed: "< jdk-11.0.20+8-jre_root_directory>/bin/java" -classpath "/tmp/install.dir.12059/InstallerData:/tmp/install.dir.12059/InstallerData/installer.zip:" com.netegrity.brlib.customcode.GetJavaDetails\nReturn Value: Error: Could not find or load main class com.netegrity.brlib.customcode.GetJavaDetails
Caused by: java.lang.ClassNotFoundException: com.netegrity.brlib.customcode.GetJavaDetails
\nStdout: {2}\nStderr: {3}

*****Custom Action:

Resolution

This problem is fixed in the R12.8.8 release.

If anyone experiencing this problem in release 12.8.7 or older, please follow these instructions to work around the problem:

------ For Red Hat Linux platforms:

Set the following environment variable, then start the installation:

JAVA_TOOL_OPTIONS='-Djdk.util.zip.disableZip64ExtraFieldValidation=true'

------ For Windows Platforms:

Set the following environment variable, then start the installation:

_JAVA_OPTIONS=-Djdk.util.zip.disableZip64ExtraFieldValidation=true

Additional Information

This problem also affects the CA Access Gateway (Secure Proxy Server) installer program and has the same workaround.

The Access Gateway version of this document can be viewed here: Access Gateway installer does not recognize JDK 11.0.20 - Invalid JDK/JVM error or installer fails to launch.