SP Startup takes 20+ minutes

[Scott Koranda]

> What options do I have to speed up the SP startup?
> 

With some deployments we have put in place a cron job that
does essentially this:

#!/bin/bash

cd /var/cache/shibboleth ; /usr/bin/curl -o InCommon-metadata-unverified.xml http://md.incommon.org/InCommon/InCommon-metadata.xml

if [ $? -ne 0 ]
  then 
    echo "curl download failed"
    exit
fi

/usr/bin/xmlsec1 --verify --pubkey-cert-pem /etc/shibboleth/inc-md-cert.pem --id-attr:ID "urn:oasis:names:tc:SAML:2.0:metadata:EntitiesDescriptor" /var/cache/shibboleth/InCommon-metadata-unverified.xml

if [ $? -ne 0 ]
  then
    echo "signature check failed"
    exit
fi

cp /var/cache/shibboleth/InCommon-metadata-unverified.xml /var/cache/shibboleth/InCommon-metadata-verified.xml

Then we configured the SP to no longer run the signature filter on the file

/var/cache/shibboleth/InCommon-metadata-verified.xml

That allowed us to decouple the checking of the signature from the SP
startup.

I suspect there is a better directory to use than /var/cache/shibboleth
since I would not be suprised if the shibd daemon "owns" that directory
and arbitrarily clean files in that directory, but I have not had time
yet to follow up on that.

You should be sure you understand the implications of such a change
and you should put in place a level of monitoring that you are comfortable
with for your production deployments since obviously the Shib SP in such
a configuration can no longer manage retries and the like.

Thanks,

Scott K for LIGO