SP Startup takes 20+ minutes

[Jozef Misutka]

2Scott: ad memory, the system has 4GB available.

On 26 April 2016 at 16:01, Scott Koranda <skoranda at gmail.com> wrote:

> > What options do I have to speed up the SP startup?
> >
>
> With some deployments we have put in place a cron job that
> does essentially this:
>
> #!/bin/bash
>
> cd /var/cache/shibboleth ; /usr/bin/curl -o
> InCommon-metadata-unverified.xml
> http://md.incommon.org/InCommon/InCommon-metadata.xml
>
> if [ $? -ne 0 ]
>   then
>     echo "curl download failed"
>     exit
> fi
>
> /usr/bin/xmlsec1 --verify --pubkey-cert-pem
> /etc/shibboleth/inc-md-cert.pem --id-attr:ID
> "urn:oasis:names:tc:SAML:2.0:metadata:EntitiesDescriptor"
> /var/cache/shibboleth/InCommon-metadata-unverified.xml
>
> if [ $? -ne 0 ]
>   then
>     echo "signature check failed"
>     exit
> fi
>
> cp /var/cache/shibboleth/InCommon-metadata-unverified.xml
> /var/cache/shibboleth/InCommon-metadata-verified.xml
>
> Then we configured the SP to no longer run the signature filter on the file
>

Can you provide a working example on how to disable it? Thank you.

best,
jm


>
> /var/cache/shibboleth/InCommon-metadata-verified.xml
>
> That allowed us to decouple the checking of the signature from the SP
> startup.
>
> I suspect there is a better directory to use than /var/cache/shibboleth
> since I would not be suprised if the shibd daemon "owns" that directory
> and arbitrarily clean files in that directory, but I have not had time
> yet to follow up on that.
>
> You should be sure you understand the implications of such a change
> and you should put in place a level of monitoring that you are comfortable
> with for your production deployments since obviously the Shib SP in such
> a configuration can no longer manage retries and the like.
>
> Thanks,
>
> Scott K for LIGO
> --
> To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160429/3b24a2f6/attachment-0001.html>