IdP 2.3.2 and FilesystemMetadataProvider refresh

[Chad La Joie]

Sorry, I should have been more clear.  You need to turn on debug
logging for the metadata code which actually lives in OpenSAML, not
the IdP itself.  I thought the specific package was noted on our
logging docs.  It wasn't so I'm adding it now.  Check the following
URL in about 2 minutes:

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPLogging

On Fri, Feb 3, 2012 at 12:03, Kevin Hall <hallk at stanford.edu> wrote:
> On 9/30/2011 6:16 PM, Chad La Joie wrote:
>>
>> This has been covered a couple times on the list.  Having a min and
>> max refresh delay that are exactly the same is a meaningless
>> configuration.
>>
>> Also, if you look in the logs it will tell you when the next refresh
>> is scheduled.
>
>
> Hi,
>
> I am not getting the log entry for the next refresh of the metadata. We are
> just now looking into adding the minRefreshDelay and maxRefreshDelay after
> upgrading to 2.3.5 a couple of months ago.  Can I get a sanity check here
> please?
>
>    <MetadataProvider xmlns="urn:mace:shibboleth:2.0:metadata"
>        id="ICMD" xsi:type="FileBackedHTTPMetadataProvider"
>
> metadataURL="http://wayf.incommonfederation.org/InCommon/InCommon-metadata.xml"
>        backingFile="/etc/shibboleth-idp/metadata/InCommon-metadata.xml"
>        minRefreshDelay="PT10M" maxRefreshDelay="PT20M">
>        <MetadataFilter xsi:type="ChainingFilter">
>            <!-- Require metadata expiration at least monthly (28 days) -->
>            <MetadataFilter xsi:type="RequiredValidUntil"
> maxValidityInterval="P28DT0H0M0.000S" />
>            <MetadataFilter xsi:type="SignatureValidation"
>                trustEngineRef="ICTrust" requireSignedMetadata="true" />
>            <MetadataFilter xsi:type="EntityRoleWhiteList">
>                <RetainedRole>samlmd:SPSSODescriptor</RetainedRole>
>            </MetadataFilter>
>        </MetadataFilter>
>    </MetadataProvider>
>
> Does a metadata file need to be updated/edited before a refresh is
> scheduled? I was assuming that these values would cause it to refresh within
> 10-20 minutes no matter what.
>
> Thanks,
> -Kevin



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered