[JIRA] Created: (JOST-170) Discard entityId instead of entire MetadataProvider

[pbrusten@idp.protectnetwork.org (JIRA)]

Discard entityId instead of entire MetadataProvider
---------------------------------------------------

                 Key: JOST-170
                 URL: https://issues.shibboleth.net/jira/browse/JOST-170
             Project: OpenSAML 2 - Java
          Issue Type: Improvement
          Components: SAML 2
    Affects Versions: 2.5.0
            Reporter: pbrusten at idp.protectnetwork.org
            Assignee: Chad La Joie
            Priority: Minor


Whenever you startup or restart an IdP and the there is a validation error for an EntityDescriptor, the entire MetadataProvider is discarded and cannot be used anymore, until the error is fixed.

In simulated this problem in a lab environment. An EntityDescriptor of the MetadataProvider contained an invalid digital Signature. This caused the following ERROR's in our log:

17:52:57.426 - ERROR [org.opensaml.saml2.metadata.provider.SignatureValidationFilter:311] -  -  Signature trust establishment failed for metadata entry https://sp.example.org
17:52:57.427 - ERROR [org.opensaml.saml2.metadata.provider.SignatureValidationFilter:254] -  -  EntityDescriptor 'https://sp.example.org' failed signature verification, removing from metadata provider
17:52:57.427 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider:246] -  -  Error occurred while attempting to refresh metadata from 'https://federation.org/metadata.xml', next refresh for metadata from '300000' will occur in approximately {}ms
17:52:57.429 - ERROR [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:414] -  -  Metadata provider failed to properly initializing, continuing on without metadata

So instead of loading the other EntityDescriptors, part of this MetadataProvider, he discards the entire MetadataProvider because of an error in one of them. It would be better to only discard the bad entityID.


If you reload a MetadataProvider at runtime, it falls back on a previous version in memory. This only becomes a problem when you restart your IdP.




--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira