issue with CDS 1.2.0?

Tue Mar 20 16:27:11 GMT 2012

It appears that the showUnusableIdPs="true" setting is not having the intended effect.

If I create a local file with an EntitiesDescriptor containing both my SP and the ProtectNetwork IdP, then the DS displays ProtectNetwork in the left-side text box as a viable option.

If that same local file doesn't have my SP in the EntitiesDescriptor, then the PN option is not displayed.

FWIW, I have showUnusableIdPs="true" set in both the Default element and in this particular DiscoveryServiceHandler.

> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-
> bounces at shibboleth.net] On Behalf Of Caskey, Paul
> Sent: Tuesday, March 20, 2012 11:01 AM
> To: Shib Users
> Subject: RE: issue with CDS 1.2.0?
> 
> The logs indicate a normal startup - no WARN or ERROR.
> 
> It grabs and processes the metadata in question just fine:
> 10:46:20.004 - INFO
> [edu.internet2.middleware.shibboleth.wayf.IdPSiteSet:159] - Loading
> Metadata for ProtectNetwork Login
> 10:46:20.004 - DEBUG
> [edu.internet2.middleware.shibboleth.wayf.IdPSiteSet:341] - Metadata
> provider 'protnet' HTTP request timeout: 5000ms
> 10:46:20.004 - DEBUG
> [edu.internet2.middleware.shibboleth.wayf.IdPSiteSet:231] - Metadata
> provider 'protnet' refreshDelayFactor set to 0.75
> 10:46:20.004 - DEBUG
> [edu.internet2.middleware.shibboleth.wayf.IdPSiteSet:263] - Metadata
> provider 'protnet' maxRefreshDelay set to 14400000
> 10:46:20.004 - DEBUG
> [edu.internet2.middleware.shibboleth.wayf.IdPSiteSet:298] - Metadata
> provider 'protnet' minRefreshDelay set to 300000
> 10:46:20.004 - DEBUG
> [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvide
> r:253] - Beginning refresh of metadata from
> 'http://www.protectnetwork.org/protectnetwork-metadata.xml'
> 10:46:20.004 - DEBUG
> [org.opensaml.saml2.metadata.provider.HTTPMetadataProvider:249] -
> Attempting to fetch metadata document from
> 'http://www.protectnetwork.org/protectnetwork-metadata.xml'
> 10:46:20.051 - DEBUG
> [org.opensaml.saml2.metadata.provider.HTTPMetadataProvider:334] -
> Attempting to extract metadata from response to request for metadata from
> 'http://www.protectnetwork.org/protectnetwork-metadata.xml'
> 10:46:20.082 - DEBUG
> [org.opensaml.saml2.metadata.provider.HTTPMetadataProvider:268] -
> Successfully fetched 6008bytes of metadata from
> http://www.protectnetwork.org/protectnetwork-metadata.xml
> 10:46:20.082 - DEBUG
> [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvide
> r:260] - Processing new metadata from
> 'http://www.protectnetwork.org/protectnetwork-metadata.xml'
> 10:46:20.082 - DEBUG
> [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvide
> r:344] - Unmarshalling metadata from
> 'http://www.protectnetwork.org/protectnetwork-metadata.xml'
> 10:46:20.082 - DEBUG
> [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvide
> r:388] - Filtering metadata from
> 'http://www.protectnetwork.org/protectnetwork-metadata.xml'
> 10:46:20.082 - DEBUG
> [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:490] -
> Applying metadata filter
> 10:46:20.082 - DEBUG
> [org.opensaml.saml2.metadata.provider.MetadataFilterChain:54] - Applying
> filter
> edu.internet2.middleware.shibboleth.wayf.plugins.provider.BindingFilter
> 10:46:20.082 - DEBUG
> [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvide
> r:397] - Releasing cached DOM for metadata from
> 'http://www.protectnetwork.org/protectnetwork-metadata.xml'
> 10:46:20.082 - DEBUG
> [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvide
> r:400] - Post-processing metadata from
> 'http://www.protectnetwork.org/protectnetwork-metadata.xml'
> 10:46:20.082 - DEBUG
> [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvide
> r:403] - Computing expiration time for metadata from
> 'http://www.protectnetwork.org/protectnetwork-metadata.xml'
> 10:46:20.082 - DEBUG
> [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvide
> r:406] - Expiration of metadata from
> 'http://www.protectnetwork.org/protectnetwork-metadata.xml' will occur
> at 2012-03-20T19:46:20.004Z
> 10:46:20.082 - INFO
> [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvide
> r:423] - New metadata succesfully loaded for
> 'http://www.protectnetwork.org/protectnetwork-metadata.xml'
> 10:46:20.082 - INFO
> [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvide
> r:271] - Next refresh cycle for metadata provider
> 'http://www.protectnetwork.org/protectnetwork-metadata.xml' will occur
> on '2012-03-20T18:46:20.024Z' ('2012-03-20T13:46:20.024-05:00' local time)
> 
> 
> Then, on the actual request, again, everything looks fine:
> 10:46:20.129 - INFO
> [edu.internet2.middleware.shibboleth.wayf.WayfService:260] - DS
> initialization completed.
> 10:46:32.172 - INFO
> [edu.internet2.middleware.shibboleth.wayf.WayfService:272] - Handling DS
> request.
> 10:46:32.187 - DEBUG
> [edu.internet2.middleware.shibboleth.wayf.DiscoveryServiceHandler:585] -
> Processing Idp Lookup for : https://mossext.utsystem.edu/shibboleth
> 10:46:32.187 - DEBUG
> [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:518] -
> Searching for entity descriptor with an entity ID of
> https://mossext.utsystem.edu/shibboleth
> 10:46:32.187 - DEBUG
> [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:518] -
> Searching for entity descriptor with an entity ID of
> https://mossext.utsystem.edu/shibboleth
> 10:46:32.187 - DEBUG
> [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:518] -
> Searching for entity descriptor with an entity ID of
> https://mossext.utsystem.edu/shibboleth
> 10:46:32.187 - DEBUG
> [edu.internet2.middleware.shibboleth.wayf.DiscoveryServiceHandler:736] -
> Displaying WAYF selection page.
> 10:46:33.467 - INFO
> [edu.internet2.middleware.shibboleth.wayf.WayfService:272] - Handling DS
> request.
> 
> 
> 
> > -----Original Message-----
> > From: users-bounces at shibboleth.net [mailto:users-
> > bounces at shibboleth.net] On Behalf Of Rod Widdowson
> > Sent: Tuesday, March 20, 2012 10:45 AM
> > To: 'Shib Users'
> > Subject: RE: issue with CDS 1.2.0?
> >
> > > showUnusableIdPs="true" should take care of that, right?
> > Absolutely..
> >
> > Are you using DS or WAYF protocol to approach the DS?  There shouldn't
> > be a difference (modulo
> > https://issues.shibboleth.net/jira/browse/SDSJ-102) which should not
> > apply here since that IdP does have a shibboleth <SSO>.
> >
> > Is there anything interesting shown in the logs when you approach the DS?
> >
> >
> >
> > > -----Original Message-----
> > > From: users-bounces at shibboleth.net
> > > [mailto:users-bounces at shibboleth.net] On Behalf Of Caskey, Paul
> > > Sent: 20 March 2012 15:34
> > > To: Shib Users
> > > Subject: RE: issue with CDS 1.2.0?
> > >
> > > showUnusableIdPs="true" should take care of that, right?
> > > If so, I have that set for this DiscoveryServiceHandler.
> > >
> > > And, there are no metadata filters (yet).
> > >
> > > > -----Original Message-----
> > > > From: users-bounces at shibboleth.net [mailto:users-
> > > > bounces at shibboleth.net] On Behalf Of Chad La Joie
> > > > Sent: Tuesday, March 20, 2012 10:15 AM
> > > > To: Shib Users
> > > > Subject: Re: issue with CDS 1.2.0?
> > > >
> > > > Is this a case of items being filtered out before being displayed
> > > > as opposed to anything to do with the metadata itself?
> > > >
> > > > On 3/20/12 11:11 AM, Caskey, Paul wrote:
> > > > > I tried deleting the existing spool file and it did download a
> > > > > new file, but still
> > > > does not show up in the DS.
> > > > >
> > > > > Here's the log:
> > > > > 10:02:36.441 - INFO
> > > >
> > [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvi
> > > > de r:423] - New metadata succesfully loaded for
> > > > 'http://www.protectnetwork.org/protectnetwork-metadata.xml'
> > > > >
> > > > > 10:02:36.441 - INFO
> > > > >
> > > >
> > [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvi
> > > > de
> > > > > r:271] - Next refresh cycle for metadata provider
> > > > > 'http://www.protectnetwork.org/protectnetwork-metadata.xml' will
> > > > > occur on '2012-03-20T18:02:36.395Z' ('2012-03-20T13:02:36.395-05:00'
> > > > > local
> > > > > time)
> > > > >
> > > > > No WARN or ERROR messages in the log.
> > > > >
> > > > >
> > > > >
> > > > >
> > > > >> -----Original Message-----
> > > > >> From: users-bounces at shibboleth.net [mailto:users-
> > > > >> bounces at shibboleth.net] On Behalf Of Rod Widdowson
> > > > >> Sent: Tuesday, March 20, 2012 5:08 AM
> > > > >> To: 'Shib Users'
> > > > >> Subject: RE: issue with CDS 1.2.0?
> > > > >>
> > > > >> Paul,
> > > > >>
> > > > >> A major motivation point of the 1.1.3-> 1.2 upgrade was that no
> > > > >> configuration change should be needed; but that you could make
> > > > >> changes to take advantage of all the new options if you wanted.
> > > > >> So if something is needed, well that would be a bug.
> > > > >>
> > > > >> I've not been able to reproduce this locally, so I'm not sure
> > > > >> what to
> > > > suggest.
> > > > >> AFAICS you are correctly configured.
> > > > >>
> > > > >> I know you'll have checked the logs at debug so I won't offend
> > > > >> you by
> > > > asking.
> > > > >> Have you tried deleting the spool file
> > > > >> (/opt/shibboleth-ds/metadata/protectnetwork-metadata.xml) just
> > > > >> in case that is implicated?
> > > > >>
> > > > >> /Rod
> > > > >>
> > > > >>
> > > > >>> -----Original Message-----
> > > > >>> From: users-bounces at shibboleth.net
> > > > >>> [mailto:users-bounces at shibboleth.net] On Behalf Of Caskey,
> > > > >>> Paul
> > > > >>> Sent: 19 March 2012 21:28
> > > > >>> To: users at shibboleth.net
> > > > >>> Subject: issue with CDS 1.2.0?
> > > > >>>
> > > > >>> I'm having trouble getting the new DS to use a metadata source
> > > > >>> in my config which contains only one entry.  This has been in
> > > > >>> the config for years and only 1.2.0 is having a problem
> > > > >>> (identical config in
> > > > >>> 1.1.3 works as expected).
> > > > >>>
> > > > >>> For example, we have a categorized (list of lists=true) DS
> > > > >>> which lists protectnetwork.org as its own "federation" in the
> > > > >>> left side text
> > box.
> > > > >>>
> > > > >>> Upgrading an existing CDS from 1.1.3 to 1.2.0 makes
> > > > >>> protectnetwork disappear from the CDS page (no changes were
> > made
> > > > >>> to wayfconfig.xml during the upgrade).  I've tried enclosing
> > > > >>> their metadata in an EntitiesDescriptor, but that didn't help.
> > > > >>> I can put their entity metadata into
> > > > >> either fed1 or fed2 metadata and it shows up in the list just fine.
> > > > >>>
> > > > >>> Here's the relevant config (fed1 and fed2 are listed in the
> > > > >>> CDS, while
> > > > >> protectnetwork is not):
> > > > >>>
> > > > >>
> > > > >>
> > > > >> [Snip]
> > > > >>
> > > > >> --
> > > > >> To unsubscribe from this list send an email to users-
> > > > >> unsubscribe at shibboleth.net
> > > > > --
> > > > > To unsubscribe from this list send an email to
> > > > > users-unsubscribe at shibboleth.net
> > > > --
> > > > To unsubscribe from this list send an email to users-
> > > > unsubscribe at shibboleth.net
> > > --
> > > To unsubscribe from this list send an email to
> > > users-unsubscribe at shibboleth.net
> >
> > --
> > To unsubscribe from this list send an email to users-
> > unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to users-
> unsubscribe at shibboleth.net