IdP 2.3.2 and FilesystemMetadataProvider refresh

[Chad La Joie]

This has been covered a couple times on the list.  Having a min and
max refresh delay that are exactly the same is a meaningless
configuration.

Also, if you look in the logs it will tell you when the next refresh
is scheduled.

On Fri, Sep 30, 2011 at 21:05, Leung, Warren <wleung at it.ucla.edu> wrote:
> Hi,
> I am trying to upgrade my IdP 2.2.1 instance to IdP 2.3.2.  I am seeing a
> strange issue with FilesystemMetadataProvider.  Below is my Chaining
> MetadataProvider in my relying-party.xml
>     <metadata:MetadataProvider id="ShibbolethMetadata"
> xsi:type="metadata:ChainingMetadataProvider">
>         <!-- Load the IdP's own metadata.  This is necessary for artifact
> support. -->
>         <metadata:MetadataProvider id="IdPMD"
> xsi:type="metadata:ResourceBackedMetadataProvider"
> xmlns="urn:mace:shibboleth:2.0:metadata">
>                 <MetadataResource xsi:type="resource:FilesystemResource"
> file="/usr/local/tomcat/webapps/idp/WEB-INF/classes/conf/idp-metadata.xml"/>
>         </metadata:MetadataProvider>
>
>        <metadata:MetadataProvider id="metadata"
> xsi:type="metadata:FilesystemMetadataProvider"
> xmlns="urn:mace:shibboleth:2.0:metadata"
>                         maxRefreshDelay ="PT5M" minRefreshDelay="PT5M"
>
> metadataFile="/usr/local/tomcat/webapps/idp/WEB-INF/classes/conf/metadata.xml">
>            </metadata:MetadataProvider>
>     </metadata:MetadataProvider>
>
> We have about 300-400 entries in our metadata file.  We have a process where
> we make metadata changes and put them in a staging folder before doing a
> "cp" into the actual directory location.  I noticed that in 2.3.2 that even
> with a PT5M setting that the file doesn't reload.  In the logs it usually
> displays the messages below when trying to refresh metadata.  The logs no
> longer display the message after changes were made.  They are also not
> reflected in the SP I made changes to.  The data in the metadata.xml file
> was visually inspected and the changes that were made exist.  The data just
> doesn't get refreshed.
> 2011-09-30-16:41:59.253 DEBUG [] Write lock over cache acquired
> 2011-09-30-16:41:59.253 INFO  [] PKIX validation info cache cleared
> 2011-09-30-16:41:59.253 DEBUG [] Write lock over cache released
> 2011-09-30-16:41:59.253 DEBUG [] Write lock over cache acquired
> 2011-09-30-16:41:59.253 INFO  [] PKIX validation info cache cleared
> 2011-09-30-16:41:59.253 DEBUG [] Write lock over cache released
> The strange thing is that it refreshes when I do a manual edit through vi or
> another editor.  Also all other files like attribute-filter.xml and
> relying-party.xml refresh perfectly fine through both processes, so I would
> assume it isn't a permissions issue.  All the files have the same read/write
> access and same user owns the files.
> I would assume that all the refreshing of files uses the same shib-commons
> code, so it doesn't seem like a bug.  Is it simply a permissions issue or
> maybe OS issue?
> Thanks
> Warren
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered