<style>
/* Changing the layout to use less space for mobiles */
@media screen and (max-device-width: 480px), screen and (-webkit-min-device-pixel-ratio: 2) {
#email-body { min-width: 30em !important; }
#email-page { padding: 8px !important; }
#email-banner { padding: 8px 8px 0 8px !important; }
#email-avatar { margin: 1px 8px 8px 0 !important; padding: 0 !important; }
#email-fields { padding: 0 8px 8px 8px !important; }
#email-gutter { width: 0 !important; }
}
</style>
<div id="email-body">
<table id="email-wrap" align="center" border="0" cellpadding="0" cellspacing="0" style="background-color:#f0f0f0;color:#000000;width:100%;">
<tr valign="top">
<td id="email-page" style="padding:16px !important;">
<table align="center" border="0" cellpadding="0" cellspacing="0" style="background-color:#ffffff;border:1px solid #bbbbbb;color:#000000;width:100%;">
<tr valign="top">
<td bgcolor="#ffffff" style="background-color:#ffffff;color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;line-height:1;"><img src="https://shibboleth.net/images/shib_240x83.png" alt="" style="vertical-align:top;" /></td>
</tr><tr valign="top">
<td id="email-banner" style="padding:32px 32px 0 32px;">
<table align="left" border="0" cellpadding="0" cellspacing="0" width="100%" style="width:100%;">
<tr valign="top">
<td style="color:#505050;font-family:Arial,FreeSans,Helvetica,sans-serif;padding:0;">
<img id="email-avatar" src="https://issues.shibboleth.net/jira/secure/useravatar?avatarId=10202" alt="" height="48" width="48" border="0" align="left" style="padding:0;margin: 0 16px 16px 0;" />
<div id="email-action" style="padding: 0 0 8px 0;font-size:12px;line-height:18px;">
<a class="user-hover" rel="nbic13/78vnyih2cwi12uhtgkrs=@https://idp.renater.fr/idp/shibboleth" id="email_nbic13/78vnyih2cwi12uhtgkrs=@https://idp.renater.fr/idp/shibboleth" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=nbic13%2F78vnyih2cwi12uhtgkrs%3D%40https%3A%2F%2Fidp.renater.fr%2Fidp%2Fshibboleth" style="color:#326ca6;">Salaun Olivier</a>
commented on <img src="https://issues.shibboleth.net/jira/images/icons/issuetypes/bug.png" height="16" width="16" border="0" align="absmiddle" alt="Bug"> <a style='color:#326ca6;text-decoration:none;' href='https://issues.shibboleth.net/jira/browse/JOST-220'>JOST-220</a>
</div>
<div id="email-summary" style="font-size:16px;line-height:20px;padding:2px 0 16px 0;">
<a style='color:#326ca6;text-decoration:none;' href='https://issues.shibboleth.net/jira/browse/JOST-220'><strong>IdP stopping metadata retrieval</strong></a>
</div>
</td>
</tr>
</table>
</td>
</tr>
<tr valign="top">
<td id="email-fields" style="padding:0 32px 32px 32px;">
<table border="0" cellpadding="0" cellspacing="0" style="padding:0;text-align:left;width:100%;" width="100%">
<tr valign="top">
<td id="email-gutter" style="width:64px;white-space:nowrap;"></td>
<td>
<table border="0" cellpadding="0" cellspacing="0" width="100%">
<tr valign="top">
<td colspan="2" style="color:#000000;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:12px;padding:0 0 16px 0;width:100%;">
<div class="comment-block" style="background-color:#edf5ff;border:1px solid #dddddd;color:#000000;padding:12px;"><p>Hello,</p>
<p>We've had another similar issue with our IdP (Shibboleth IdP 2.4.2, OpenSAML 2.6.3).<br/>
I realized this morning that our metadata file had not been refreshed since November 30th</p>
<p>/opt/shibboleth-idp/metadata# ls -ltr<br/>
total 13836<br/>
<del>rw-r</del><del>r</del>- 1 tomcat tomcat 5322 juin 8 2011 idp-metadata.xml<br/>
<del>rw-r</del><del>r</del>- 1 tomcat tomcat 5357 nov. 30 11:52 stats.renater-metadata.xml<br/>
<del>rw-r</del><del>r</del>- 1 tomcat tomcat 3585832 nov. 30 13:35 sps-renater-metadata.xml<br/>
<del>rw-r</del><del>r</del>- 1 tomcat tomcat 7345814 nov. 30 13:45 sps-edugain-metadata.xml</p>
<p>Therefore authentication would fail with error "SAML 2 SSO profile is not configured for relying party XXX" because metadata files had expired.</p>
<p>Reloading the IdP's Tomcat server has fixed the problem; metadata file has been reloaded.</p>
<p>I checked the log files to find out what happened around Nov 30th 13h45.<br/>
Extracts from idp-process.log:<br/>
13:45:31.233 - INFO <span class="error">[edu.internet2.middleware.shibboleth.common.security.MetadataPKIXValidationInformationResolver:803]</span> - PKIX validation info cache cleared<br/>
13:45:31.233 - INFO <span class="error">[edu.internet2.middleware.shibboleth.common.security.MetadataPKIXValidationInformationResolver:803]</span> - PKIX validation info cache cleared</p>
<p>Then nothing mentioning Metadata refresh.</p>
<p>The IdP is configured to reload metadata file every 5 minutes. The log file, before Nov 30th 13h45 reveals traces of metadata update evry 5 minutes until 13h45:<br/>
12:38:58.478 - INFO <span class="error">[edu.internet2.middleware.shibboleth.common.security.MetadataPKIXValidationInformationResolver:803]</span> - PKIX validation info cache cleared<br/>
12:38:58.478 - INFO <span class="error">[edu.internet2.middleware.shibboleth.common.security.MetadataPKIXValidationInformationResolver:803]</span> - PKIX validation info cache cleared<br/>
12:46:24.834 - INFO <span class="error">[edu.internet2.middleware.shibboleth.common.security.MetadataPKIXValidationInformationResolver:803]</span> - PKIX validation info cache cleared<br/>
12:46:24.861 - INFO <span class="error">[edu.internet2.middleware.shibboleth.common.security.MetadataPKIXValidationInformationResolver:803]</span> - PKIX validation info cache cleared<br/>
12:49:26.776 - INFO <span class="error">[edu.internet2.middleware.shibboleth.common.security.MetadataPKIXValidationInformationResolver:803]</span> - PKIX validation info cache cleared<br/>
12:49:26.832 - INFO <span class="error">[edu.internet2.middleware.shibboleth.common.security.MetadataPKIXValidationInformationResolver:803]</span> - PKIX validation info cache cleared<br/>
13:07:19.470 - INFO <span class="error">[edu.internet2.middleware.shibboleth.common.security.MetadataPKIXValidationInformationResolver:803]</span> - PKIX validation info cache cleared<br/>
13:07:19.471 - INFO <span class="error">[edu.internet2.middleware.shibboleth.common.security.MetadataPKIXValidationInformationResolver:803]</span> - PKIX validation info cache cleared<br/>
13:20:02.758 - INFO <span class="error">[edu.internet2.middleware.shibboleth.common.security.MetadataPKIXValidationInformationResolver:803]</span> - PKIX validation info cache cleared<br/>
13:20:02.759 - INFO <span class="error">[edu.internet2.middleware.shibboleth.common.security.MetadataPKIXValidationInformationResolver:803]</span> - PKIX validation info cache cleared<br/>
13:35:37.802 - INFO <span class="error">[edu.internet2.middleware.shibboleth.common.security.MetadataPKIXValidationInformationResolver:803]</span> - PKIX validation info cache cleared<br/>
13:35:37.802 - INFO <span class="error">[edu.internet2.middleware.shibboleth.common.security.MetadataPKIXValidationInformationResolver:803]</span> - PKIX validation info cache cleared<br/>
13:45:31.233 - INFO <span class="error">[edu.internet2.middleware.shibboleth.common.security.MetadataPKIXValidationInformationResolver:803]</span> - PKIX validation info cache cleared<br/>
13:45:31.233 - INFO <span class="error">[edu.internet2.middleware.shibboleth.common.security.MetadataPKIXValidationInformationResolver:803]</span> - PKIX validation info cache cleared</p>
<p>It is very probable that this IdP could not contact the server that publishes the federation metadata on Nov 30th. However this has been sorted out in the meanwhile.</p>
<p>Could it be that the bug is not fixed in OpenSAML 2.6.3?</p>
<p>Thanks.</p></div>
<div style="color:#505050;padding:4px 0 0 0;"> </div>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td><!-- End #email-page -->
</tr>
<tr valign="top">
<td style="color:#505050;font-family:Arial,FreeSans,Helvetica,sans-serif;font-size:10px;line-height:14px;padding: 0 16px 16px 16px;text-align:center;">
This message is automatically generated by JIRA.<br />
If you think it was sent incorrectly, please contact your JIRA administrators<br />
For more information on JIRA, see: <a style='color:#326ca6;' href='http://www.atlassian.com/software/jira'>http://www.atlassian.com/software/jira</a>
</td>
</tr>
</table><!-- End #email-wrap -->
</div><!-- End #email-body -->