[JIRA] Closed: (JOST-170) Discard entityId instead of entire MetadataProvider

[Chad La Joie (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/JOST-170?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Chad La Joie closed JOST-170.
-----------------------------

    Resolution: Incomplete

Discussion was not taken to dev list, nothing more to do here.

> Discard entityId instead of entire MetadataProvider
> ---------------------------------------------------
>
>                 Key: JOST-170
>                 URL: https://issues.shibboleth.net/jira/browse/JOST-170
>             Project: OpenSAML 2 - Java
>          Issue Type: Improvement
>          Components: SAML 2
>    Affects Versions: 2.5.0
>            Reporter: pbrusten at idp.protectnetwork.org
>            Assignee: Chad La Joie
>            Priority: Minor
>
> Whenever you startup or restart an IdP and the there is a validation error for an EntityDescriptor, the entire MetadataProvider is discarded and cannot be used anymore, until the error is fixed.
> In simulated this problem in a lab environment. An EntityDescriptor of the MetadataProvider contained an invalid digital Signature. This caused the following ERROR's in our log:
> 17:52:57.426 - ERROR [org.opensaml.saml2.metadata.provider.SignatureValidationFilter:311] -  -  Signature trust establishment failed for metadata entry https://sp.example.org
> 17:52:57.427 - ERROR [org.opensaml.saml2.metadata.provider.SignatureValidationFilter:254] -  -  EntityDescriptor 'https://sp.example.org' failed signature verification, removing from metadata provider
> 17:52:57.427 - DEBUG [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider:246] -  -  Error occurred while attempting to refresh metadata from 'https://federation.org/metadata.xml', next refresh for metadata from '300000' will occur in approximately {}ms
> 17:52:57.429 - ERROR [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:414] -  -  Metadata provider failed to properly initializing, continuing on without metadata
> So instead of loading the other EntityDescriptors, part of this MetadataProvider, he discards the entire MetadataProvider because of an error in one of them. It would be better to only discard the bad entityID.
> If you reload a MetadataProvider at runtime, it falls back on a previous version in memory. This only becomes a problem when you restart your IdP.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira