<style>
/* Changing the layout to use less space for mobiles */
@media screen and (max-device-width: 480px), screen and (-webkit-min-device-pixel-ratio: 2) {
#email-body { min-width: 30em !important; }
#email-page { padding: 8px !important; }
#email-banner { padding: 8px 8px 0 8px !important; }
#email-avatar { margin: 1px 8px 8px 0 !important; padding: 0 !important; }
#email-fields { padding: 0 8px 8px 8px !important; }
#email-gutter { width: 0 !important; }
}
</style>
<div id="email-body">
<table id="email-wrap" align="center" border="0" cellpadding="0" cellspacing="0" style="background-color:#f0f0f0;color:#000000;width:100%;">
<tr valign="top">
<td id="email-page" style="padding:16px !important;">
<table align="center" border="0" cellpadding="0" cellspacing="0" style="background-color:#ffffff;border:1px solid #bbbbbb;color:#000000;width:100%;">
<tr valign="top">
<td bgcolor="#ffffff" style="background-color:#ffffff;color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;line-height:1;"><img src="https://shibboleth.net/images/shib_240x83.png" alt="" style="vertical-align:top;" /></td>
</tr><tr valign="top">
<td id="email-banner" style="padding:32px 32px 0 32px;">
<table align="left" border="0" cellpadding="0" cellspacing="0" width="100%" style="width:100%;">
<tr valign="top">
<td style="color:#505050;font-family:Arial,FreeSans,Helvetica,sans-serif;padding:0;">
<img id="email-avatar" src="https://issues.shibboleth.net/jira/secure/useravatar?avatarId=10202" alt="" height="48" width="48" border="0" align="left" style="padding:0;margin: 0 16px 16px 0;" />
<div id="email-action" style="padding: 0 0 8px 0;font-size:12px;line-height:18px;">
<a class="user-hover" rel="nbic13/78vnyih2cwi12uhtgkrs=@https://idp.renater.fr/idp/shibboleth" id="email_nbic13/78vnyih2cwi12uhtgkrs=@https://idp.renater.fr/idp/shibboleth" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=nbic13%2F78vnyih2cwi12uhtgkrs%3D%40https%3A%2F%2Fidp.renater.fr%2Fidp%2Fshibboleth" style="color:#326ca6;">nbic13/78vnyih2cwi12uhtgkrs=@https://idp.renater.fr/idp/shibboleth</a>
commented on <img src="https://issues.shibboleth.net/jira/images/icons/issuetypes/bug.png" height="16" width="16" border="0" align="absmiddle" alt="Bug"> <a style='color:#326ca6;text-decoration:none;' href='https://issues.shibboleth.net/jira/browse/JOST-220'>JOST-220</a>
</div>
<div id="email-summary" style="font-size:16px;line-height:20px;padding:2px 0 16px 0;">
<a style='color:#326ca6;text-decoration:none;' href='https://issues.shibboleth.net/jira/browse/JOST-220'><strong>IdP stopping metadata retrieval</strong></a>
</div>
</td>
</tr>
</table>
</td>
</tr>
<tr valign="top">
<td id="email-fields" style="padding:0 32px 32px 32px;">
<table border="0" cellpadding="0" cellspacing="0" style="padding:0;text-align:left;width:100%;" width="100%">
<tr valign="top">
<td id="email-gutter" style="width:64px;white-space:nowrap;"></td>
<td>
<table border="0" cellpadding="0" cellspacing="0" width="100%">
<tr valign="top">
<td colspan="2" style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 16px 0;width:100%;">
<div class="comment-block" style="background-color:#edf5ff;border:1px solid #dddddd;color:#000000;padding:12px;"><p>Hello,</p>
<p>We are running a 2.4.0 Shibboleth IdP.</p>
<p>Yesterday we noticed that our IdP had failed to synchronize our federation metadata. It resulted in the IdP failing to answer SPs authentication requests with the following error message : WARN <span class="error">[org.opensaml.saml2.binding.security.SAML2AuthnRequestsSignedRule:81]</span> - SPSSODescriptor role metadata for entityID 'https://rms.renater.fr/' could not be resolved</p>
<p>The problem was manually fixed with an IdP restart, thus refreshing the local copy of the metadata.</p>
<p>Here is what our metadata definition looks like in the relying-party.xml file :</p>
<div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent">
<pre class="code-xml"> <metadata:MetadataProvider id=<span class="code-quote">"RENATERMD"</span> xsi:type=<span class="code-quote">"metadata:FileBackedHTTPMetadataProvider"</span>
metadataURL=<span class="code-quote">"https://services-federation.renater.fr/metadata/renater-metadata.xml"</span>
backingFile=<span class="code-quote">"/opt/shibboleth-idp/metadata/renater-metadata.xml"</span>>
<span class="code-tag"><metadata:MetadataFilter xsi:type=<span class="code-quote">"metadata:ChainingFilter"</span>></span>
<metadata:MetadataFilter xsi:type=<span class="code-quote">"metadata:RequiredValidUntil"</span>
maxValidityInterval=<span class="code-quote">"P7D"</span> />
<metadata:MetadataFilter xsi:type=<span class="code-quote">"metadata:SignatureValidation"</span>
trustEngineRef=<span class="code-quote">"shibboleth.MetadataTrustEngine"</span>
requireSignedMetadata=<span class="code-quote">"true"</span> />
<span class="code-tag"><metadata:MetadataFilter xsi:type=<span class="code-quote">"metadata:EntityRoleWhiteList"</span>></span>
<span class="code-tag"><metadata:RetainedRole></span>samlmd:SPSSODescriptor<span class="code-tag"></metadata:RetainedRole></span>
<span class="code-tag"></metadata:MetadataFilter></span>
<span class="code-tag"></metadata:MetadataFilter></span>
<span class="code-tag"></metadata:MetadataProvider></span>
</pre>
</div></div>
<p>Nothing relevent I could find in idp-process.log or catalina.out.</p>
<p>Strange coincidence : a French university (u-paris2.fr) has just reported the same issue today; their metadata file had not been updated for 5 days. They also had to restart their IdP. I don't know what version of the Shibboleth IdP they are using.</p>
<p>Because we have the hand on the metadata distribution server too, I had a look at its Apache logs, looking for the IP address of our IdP. It shows below that metadata get downloaded every 3 hours, but downloads stopped for 5 days :</p>
<div class="code panel" style="border-width: 1px;"><div class="codeContent panelContent">
<pre class="code-java"> <span class="code-quote">"-"</span> <span class="code-quote">"Jakarta Commons-HttpClient/3.1"</span>
193.49.159.13 - - [24/Mar/2014:23:31:25 +0100] <span class="code-quote">"GET /metadata/renater-metadata.xml HTTP/1.1"</span> 200 4061027 <span class="code-quote">"-"</span> <span class="code-quote">"Jakarta Commons-HttpClient/3.1"</span>
193.49.159.13 - - [25/Mar/2014:02:31:12 +0100] <span class="code-quote">"GET /metadata/renater-metadata.xml HTTP/1.1"</span> 200 4061027 <span class="code-quote">"-"</span> <span class="code-quote">"Jakarta Commons-HttpClient/3.1"</span>
193.49.159.13 - - [25/Mar/2014:05:31:13 +0100] <span class="code-quote">"GET /metadata/renater-metadata.xml HTTP/1.1"</span> 200 4061027 <span class="code-quote">"-"</span> <span class="code-quote">"Jakarta Commons-HttpClient/3.1"</span>
193.49.159.136 - - [25/Mar/2014:13:59:06 +0100] <span class="code-quote">"GET /metadata/renater-metadata.xml HTTP/1.1"</span> 200 4064555 <span class="code-quote">"https:<span class="code-comment">//services.renater.fr/federation/technique/metadata"</span> <span class="code-quote">"Mozilla/5.0 (Windows NT 5.1; rv:27.0) Gecko/20100101 Firefox/27.0"</span>
</span>193.49.159.13 - - [31/Mar/2014:09:20:07 +0200] <span class="code-quote">"GET /metadata/renater-metadata.xml HTTP/1.1"</span> 200 4087422 <span class="code-quote">"-"</span> <span class="code-quote">"Jakarta Commons-HttpClient/3.1"</span>
193.49.159.13 - - [31/Mar/2014:12:20:09 +0200] <span class="code-quote">"GET /metadata/renater-metadata.xml HTTP/1.1"</span> 200 4087422
</pre>
</div></div></div>
<div style="color:#505050;padding:4px 0 0 0;"> </div>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td><!-- End #email-page -->
</tr>
<tr valign="top">
<td style="color:#505050;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:10px;line-height:14px;padding: 0 16px 16px 16px;text-align:center;">
This message is automatically generated by JIRA.<br />
If you think it was sent incorrectly, please contact your JIRA administrators<br />
For more information on JIRA, see: <a style='color:#326ca6;' href='http://www.atlassian.com/software/jira'>http://www.atlassian.com/software/jira</a>
</td>
</tr>
</table><!-- End #email-wrap -->
</div><!-- End #email-body -->