IDP Relying Party Reload Behavior

[Chad La Joie]

On Sat, Aug 20, 2011 at 18:35, John Mitchell <jpmitchell at alaska.edu> wrote:
>    Gotcha. I think I tried that to no avail with the
> min/maxRefreshDelay attribute. It still had the old metadata in memory
> after it auto reloaded the config and I waited an hour. The config
> looks like this in the relying party configuration:
>
>        <MetadataProvider id="knowledge-test.alaska.edu"
> xsi:type="ResourceBackedMetadataProvider"
>            minRefreshDelay="PT15M" maxRefreshDelay="PT15M"
>            xmlns="urn:mace:shibboleth:2.0:metadata">
>            <MetadataResource xsi:type="resource:FilesystemResource"
>
> file="/opt/shibboleth-idp/metadata/knowledge-test-metadata.xml" />
>        </MetadataProvider>
>
> Am I doing something wrong?

That config looks okay.  I don't recommend setting the min and max
delay to the same amount, that just doesn't make any sense.  First, be
sure you're running the latest version of the IdP.  Then turn on
debugging for the OpenSAML metadata package to see when exactly things
will reload and actually perform the reloading.

>    Sorry about that. I will try again by backing up some and
> explaining my purpose behind what I am trying to do. I manage UA
> metadata basically by hand with a simple point to point trust model.
> This is due to the fact that at present I am leveraging Shib to
> replace a home grown trusted third party protocol implementation and
> to get my users into federated resources. So, I just store the
> metadata for each UA SP in a separate file and chain them all together
> in the relying party configuration.

Don't use a separate file per relying party, just use one file for all
manually maintained relying party metadata.  Otherwise you'll need to
add a new metadata provider for every new service that comes along.
That would require you to either turn on reloading for
relying-party.xml (something I do not recommend in a production
system) or restart the IdP.  Using a single file, with a reloading
metadata provider, you can just edit the metadata for a given SP
within the larger collection.

-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered