<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0"> <base href="https://shibboleth.atlassian.net">
<title>Message Title</title>
</head>
<body class="jira" style="color: #333333; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.429">
<table id="background-table" cellpadding="0" cellspacing="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; background-color: #f5f5f5; border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0" bgcolor="#f5f5f5"><!-- header here -->
<tbody>
<tr>
<td id="header-pattern-container" style="padding: 0; border-collapse: collapse; padding: 10px 20px">
<table id="header-pattern" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="header-avatar-image-container" valign="top" style="padding: 0; border-collapse: collapse; vertical-align: top; width: 32px; padding-right: 8px" width="32"><img id="header-avatar-image" class="image_fix" src="https://secure.gravatar.com/avatar/14245c2666d6c3a7105d001f7ce79a01?d=https%3A%2F%2Favatar-management--avatars.us-west-2.prod.public.atl-paas.net%2Finitials%2FP-1.png" height="32" width="32" border="0" style="border-radius: 3px; vertical-align: top"></td>
<td id="header-text-container" valign="middle" style="padding: 0; border-collapse: collapse; vertical-align: middle; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px"><a class="user-hover" rel="60ad33f05dc18500704c2ef8" style="color:#3b73af;; color: #3b73af; text-decoration: none" id="email_60ad33f05dc18500704c2ef8" href="https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=60ad33f05dc18500704c2ef8"> peter </a> <strong>created</strong> an issue</td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td id="email-content-container" style="padding: 0; border-collapse: collapse; padding: 0 20px">
<table id="email-content-table" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; border-spacing: 0; border-collapse: separate">
<tbody>
<tr><!-- there needs to be content in the cell for it to render in some clients -->
<td class="email-content-rounded-top mobile-expand" style="padding: 0; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 15px; background-color: #ffffff; border-left: 1px solid #cccccc; border-top: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom: 0; border-top-right-radius: 5px; border-top-left-radius: 5px; height: 10px; line-height: 10px; padding: 0 15px 0 16px; mso-line-height-rule: exactly" height="10" bgcolor="#ffffff"> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff">
<table class="page-title-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td class="page-title-pattern-first-line " style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; padding-top: 10px"><a href="https://shibboleth.atlassian.net/browse/SSPCPP?atlOrigin=eyJpIjoiN2Q0OWQ3ZTFlYjMwNGMwZWFmODU4OGIzN2IyMzJlZmQiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none">Shibboleth SP - C++</a> / <a href="https://shibboleth.atlassian.net/browse/SSPCPP-973?atlOrigin=eyJpIjoiN2Q0OWQ3ZTFlYjMwNGMwZWFmODU4OGIzN2IyMzJlZmQiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none"><img src="cid:jira-generated-image-avatar-bad14326-bf30-4ceb-9c6b-66d0ba2cc9a9" height="16" width="16" border="0" align="absmiddle" alt="Bug" style="vertical-align: text-bottom"></a> <a href="https://shibboleth.atlassian.net/browse/SSPCPP-973?atlOrigin=eyJpIjoiN2Q0OWQ3ZTFlYjMwNGMwZWFmODU4OGIzN2IyMzJlZmQiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none">SSPCPP-973</a></td>
</tr>
<tr>
<td style="vertical-align: top;; padding: 0; border-collapse: collapse; padding-right: 5px; font-size: 20px; line-height: 30px; mso-line-height-rule: exactly" class="page-title-pattern-header-container"><span class="page-title-pattern-header" style="font-family: Arial, sans-serif; padding: 0; font-size: 20px; line-height: 30px; mso-text-raise: 2px; mso-line-height-rule: exactly; vertical-align: middle"> <a href="https://shibboleth.atlassian.net/browse/SSPCPP-973?atlOrigin=eyJpIjoiN2Q0OWQ3ZTFlYjMwNGMwZWFmODU4OGIzN2IyMzJlZmQiLCJwIjoiaiJ9" style="color: #3b73af; text-decoration: none">shibd re-downloading metadata on every restart</a> </span></td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td class="email-content-main mobile-expand wrapper-special-margin" style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff; padding-top: 10px; padding-bottom: 5px" bgcolor="#ffffff">
<table class="keyvalue-table" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Issue Type:</th>
<td class="has-icon" style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"><img src="cid:jira-generated-image-avatar-bad14326-bf30-4ceb-9c6b-66d0ba2cc9a9" height="16" width="16" border="0" align="absmiddle" alt="Bug" style="vertical-align: text-bottom"> Bug</td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Affects Versions:</th>
<td style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top">3.2.2, 3.4.1</td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Assignee:</th>
<td style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"><a class="user-hover" rel="557058:5b78efc9-1379-42cc-a3f6-56c6ea3a0007" style="color:#3b73af;; color: #3b73af; text-decoration: none" id="email_557058:5b78efc9-1379-42cc-a3f6-56c6ea3a0007" href="https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007"> Scott Cantor </a></td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Created:</th>
<td style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top">24/Mar/23 2:01 PM</td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Priority:</th>
<td class="has-icon" style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"><img src="cid:jira-generated-image-static-trivial-f039f68d-aa4c-4258-99bb-ba3968100849" height="16" width="16" border="0" align="absmiddle" alt="Trivial" style="vertical-align: text-bottom"> Trivial</td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Reporter:</th>
<td style="padding: 0; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"><a class="user-hover" rel="60ad33f05dc18500704c2ef8" style="color:#3b73af;; color: #3b73af; text-decoration: none" id="email_60ad33f05dc18500704c2ef8" href="https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=60ad33f05dc18500704c2ef8"> peter </a></td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td class="email-content-main mobile-expand issue-description-container" style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff; padding-top: 5px; padding-bottom: 10px" bgcolor="#ffffff">
<table class="text-paragraph-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 2px">
<tbody>
<tr>
<td class="text-paragraph-pattern-container mobile-resize-text " style="padding: 0; border-collapse: collapse; padding: 0 0 10px"><p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0; margin-top: 0">I noticed that since we changed our metadata hosting shibd (initially v3.2.2 using libsaml 3.2.0, tested on Debian 11; then replicated with v3.4.1 from official packages using libsaml 3.2.1, tested on Rocky 9) will re-download metadata from a <tt>MetadataProvider/@type="XML"</tt> on every restart and will also re-apply a <tt>MetadataFilter/@type="Signature"</tt> every time – defeating the purpose of <tt>MetadataFilter/@verifyBackup="false"</tt>.</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">Scott identified the missing .<tt>tag</tt> file as the reason for that and seemingly a different behaviour of different web servers or server configurations providing these documents for download.</p>
<div class="code panel" style="border-width: 1px;; border: 1px solid #cccccc; background: #f5f5f5; font-size: 12px; line-height: 1.333; font-family: monospace; border: 1px solid #cccccc; -moz-border-radius: 3px; border-radius: 3px; margin: 9px 0">
<div class="codeContent panelContent" style="padding: 9px 12px">
<pre class="code-xml" style="margin: 10px 0 0; margin-top: 0; max-height: 30em; overflow: auto; white-space: pre-wrap; word-wrap: normal"><span class="code-tag" style="color: #000091"><span class="code-comment" style="color: #808080"><!-- works as expected --></span></span>
<span class="code-tag" style="color: #000091"><MetadataProvider type=<span class="code-quote" style="color: #009100">"XML"</span> url=<span class="code-quote" style="color: #009100">"http://md.incommon.org/InCommon/InCommon-metadata.xml"</span> backingFilePath=<span class="code-quote" style="color: #009100">"incommon-metadata.xml"</span>></span>
<span class="code-tag" style="color: #000091"><MetadataFilter type=<span class="code-quote" style="color: #009100">"Signature"</span> certificate=<span class="code-quote" style="color: #009100">"inc-md-cert.pem"</span> verifyBackup=<span class="code-quote" style="color: #009100">"false"</span>/></span>
<span class="code-tag" style="color: #000091"></MetadataProvider></span>
<span class="code-tag" style="color: #000091"><span class="code-comment" style="color: #808080"><!-- fails to write .tag file --></span></span>
<span class="code-tag" style="color: #000091"><MetadataProvider type=<span class="code-quote" style="color: #009100">"XML"</span> url=<span class="code-quote" style="color: #009100">"http://eduid.at/md/aconet-interfed.xml"</span> backingFilePath=<span class="code-quote" style="color: #009100">"aconet-metadata.xml"</span>></span>
<span class="code-tag" style="color: #000091"><MetadataFilter type=<span class="code-quote" style="color: #009100">"Signature"</span> certificate=<span class="code-quote" style="color: #009100">"aconet-metadata-signing.crt"</span> verifyBackup=<span class="code-quote" style="color: #009100">"false"</span>/></span>
<span class="code-tag" style="color: #000091"></MetadataProvider></span></pre>
</div>
</div> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">(Referenced certificate files can be found here <a href="https://ds.incommon.org/certs/inc-md-cert.pem" class="external-link" rel="nofollow noreferrer" style="color: #3b73af; text-decoration: none">https://ds.incommon.org/certs/inc-md-cert.pem</a> and here <a href="https://eduid.at/md/aconet-metadata-signing.crt" class="external-link" rel="nofollow noreferrer" style="color: #3b73af; text-decoration: none">https://eduid.at/md/aconet-metadata-signing.crt</a> respectively, not that this matters.)</p>
<div class="preformatted panel" style="border-width: 1px;; border: 1px solid #cccccc; background: #f5f5f5; font-size: 12px; line-height: 1.333; font-family: monospace; border: 1px solid #cccccc; -moz-border-radius: 3px; border-radius: 3px; margin: 9px 0">
<div class="preformattedContent panelContent" style="padding: 9px 12px">
<pre style="margin: 10px 0 0; margin-top: 0; max-height: 30em; overflow: auto; white-space: pre-wrap; word-wrap: normal; white-space: pre; word-break: normal; word-wrap: break-word; word-break: break-all; white-space: pre-wrap">$ ls /var/cache/shibboleth/
aconet-metadata.xml incommon-metadata.xml incommon-metadata.xml.tag</pre>
</div>
</div> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">Eyeballing the respective HTTP Response Headers they seem OK but something must be off in the case of eduid.at. cURL used on the cli as below uses HTTP/2 for eduid and HTTP/1.1 for InC, for example:</p>
<div class="preformatted panel" style="border-width: 1px;; border: 1px solid #cccccc; background: #f5f5f5; font-size: 12px; line-height: 1.333; font-family: monospace; border: 1px solid #cccccc; -moz-border-radius: 3px; border-radius: 3px; margin: 9px 0">
<div class="preformattedContent panelContent" style="padding: 9px 12px">
<pre style="margin: 10px 0 0; margin-top: 0; max-height: 30em; overflow: auto; white-space: pre-wrap; word-wrap: normal; white-space: pre; word-break: normal; word-wrap: break-word; word-break: break-all; white-space: pre-wrap">$ curl -sSI http://md.incommon.org/InCommon/InCommon-metadata.xml
HTTP/1.1 200 OK
Date: Fri, 24 Mar 2023 17:44:35 GMT
Server: Apache
Last-Modified: Thu, 23 Mar 2023 19:24:55 GMT
ETag: "5c536c2-5f7963b4d4653"
Accept-Ranges: bytes
Content-Length: 96810690
Content-Type: application/samlmetadata+xml
$ curl -sSI https://eduid.at/md/aconet-interfed.xml
HTTP/2 200
strict-transport-security: max-age=15768000
last-modified: Fri, 24 Mar 2023 07:12:20 GMT
etag: "4b1e931-5f7a01d2efd00"
accept-ranges: bytes
content-length: 78768433
content-type: application/samlmetadata+xml
date: Fri, 24 Mar 2023 17:44:38 GMT
server: Apache</pre>
</div>
</div> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">ETag response header values are stable across several requests. I’ve changed the web server’s etag values-generating algorithm (from default <a href="https://httpd.apache.org/docs/2.4/en/mod/core.html#fileetag" class="external-link" rel="nofollow noreferrer" style="color: #3b73af; text-decoration: none">“MTime Size” to “Digest”</a>) to test and while that obviously changed the values that were being generated it did not change shibd’s behaviour wrt re-downloading (so I changed it back).</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0">All data is public and involved servers are publicly accessible, making this hopefully easy to test.</p></td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff"><script type="application/ld+json">
{
"@context": "http://schema.org",
"@type": "EmailMessage",
"description": "View Issue",
"potentialAction": {
"@type": "ViewAction",
"target": "https://shibboleth.atlassian.net/browse/SSPCPP-973?inbox=true&",
"name": "View Issue"
},
"publisher": {
"@type": "Organization",
"name": "Atlassian",
"url": "https://www.atlassian.com"
}
}
</script>
<table id="actions-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px">
<tbody>
<tr>
<td id="actions-pattern-container" valign="middle" style="padding: 0; border-collapse: collapse; padding: 10px 0 10px 24px; vertical-align: middle; padding-left: 0">
<table align="left" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td class="actions-pattern-action-icon-container" style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 0; vertical-align: middle"><a href="https://shibboleth.atlassian.net/browse/SSPCPP-973#add-comment?atlOrigin=eyJpIjoiN2Q0OWQ3ZTFlYjMwNGMwZWFmODU4OGIzN2IyMzJlZmQiLCJwIjoiaiJ9" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none"> <img class="actions-pattern-action-icon-image" src="cid:jira-generated-image-static-comment-icon-135a87d4-f6e1-41fe-b06f-a252b7001bb0" alt="Add Comment" title="Add Comment" height="16" width="16" border="0" style="vertical-align: middle"> </a></td>
<td class="actions-pattern-action-text-container" style="padding: 0; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 4px; padding-left: 5px"><a href="https://shibboleth.atlassian.net/browse/SSPCPP-973#add-comment?atlOrigin=eyJpIjoiN2Q0OWQ3ZTFlYjMwNGMwZWFmODU4OGIzN2IyMzJlZmQiLCJwIjoiaiJ9" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none">Add Comment</a></td>
</tr>
</tbody>
</table></td>
</tr>
</tbody>
</table></td>
</tr> <!-- there needs to be content in the cell for it to render in some clients -->
<tr>
<td class="email-content-rounded-bottom mobile-expand" style="padding: 0; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 5px; line-height: 5px; background-color: #ffffff; border-top: 0; border-left: 1px solid #cccccc; border-bottom: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom-right-radius: 5px; border-bottom-left-radius: 5px; mso-line-height-rule: exactly" height="5" bgcolor="#ffffff"> </td>
</tr>
</tbody>
</table></td>
</tr>
<tr>
<td id="footer-pattern" style="padding: 0; border-collapse: collapse; padding: 12px 20px">
<table id="footer-pattern-container" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="footer-pattern-mobile-separated-links" class="mobile-resize-text" width="100%" colspan="2" style="padding: 0; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px">Get Jira notifications on your phone! Download the Jira Cloud app for <a href="https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail" style="color: #3b73af; text-decoration: none">Android</a> or <a href="https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8" style="color: #3b73af; text-decoration: none">iOS</a>
<hr></td>
</tr>
<tr>
<td id="footer-pattern-text" class="mobile-resize-text" width="100%" style="padding: 0; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px">This message was sent by Atlassian Jira <span id="footer-build-information">(v1001.0.0-SNAPSHOT#100219-<span title="ac3e9188e641ac08cfb28c36b366bc2114807d2f" data-commit-id="ac3e9188e641ac08cfb28c36b366bc2114807d2f}">sha1:ac3e918</span>)</span></td>
<td id="footer-pattern-logo-desktop-container" valign="top" style="padding: 0; border-collapse: collapse; padding-left: 20px; vertical-align: top">
<table style="border-collapse: collapse; mso-table-lspace: 0; mso-table-rspace: 0">
<tbody>
<tr>
<td id="footer-pattern-logo-desktop-padding" style="padding: 0; border-collapse: collapse; padding-top: 3px; opacity: 0.150"><img id="footer-pattern-logo-desktop" src="cid:jira-generated-image-static-footer-desktop-logo-388677fe-72e6-4321-adec-70b2f7fe5948" alt="Atlassian logo" title="Atlassian logo" width="192" height="24" class="image_fix"></td>
</tr>
</tbody>
</table></td>
</tr>
</tbody>
</table></td>
</tr>
</tbody>
</table>
</body>
</html>