issue with CDS 1.2.0?

Tue Mar 20 17:49:02 GMT 2012

I had a Demorganization goof.

https://issues.shibboleth.net/jira/browse/SDSJ-108

> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Caskey, Paul
> Sent: 20 March 2012 16:27
> To: Shib Users
> Subject: RE: issue with CDS 1.2.0?
> 
> It appears that the showUnusableIdPs="true" setting is not having the intended effect.
> 
> If I create a local file with an EntitiesDescriptor containing both my SP and the ProtectNetwork IdP,
> then the DS displays ProtectNetwork in the left-side text box as a viable option.
> 
> If that same local file doesn't have my SP in the EntitiesDescriptor, then the PN option is not
> displayed.
> 
> FWIW, I have showUnusableIdPs="true" set in both the Default element and in this particular
> DiscoveryServiceHandler.
> 
> 
> 
> > -----Original Message-----
> > From: users-bounces at shibboleth.net [mailto:users-
> > bounces at shibboleth.net] On Behalf Of Caskey, Paul
> > Sent: Tuesday, March 20, 2012 11:01 AM
> > To: Shib Users
> > Subject: RE: issue with CDS 1.2.0?
> >
> > The logs indicate a normal startup - no WARN or ERROR.
> >
> > It grabs and processes the metadata in question just fine:
> > 10:46:20.004 - INFO
> > [edu.internet2.middleware.shibboleth.wayf.IdPSiteSet:159] - Loading
> > Metadata for ProtectNetwork Login
> > 10:46:20.004 - DEBUG
> > [edu.internet2.middleware.shibboleth.wayf.IdPSiteSet:341] - Metadata
> > provider 'protnet' HTTP request timeout: 5000ms
> > 10:46:20.004 - DEBUG
> > [edu.internet2.middleware.shibboleth.wayf.IdPSiteSet:231] - Metadata
> > provider 'protnet' refreshDelayFactor set to 0.75
> > 10:46:20.004 - DEBUG
> > [edu.internet2.middleware.shibboleth.wayf.IdPSiteSet:263] - Metadata
> > provider 'protnet' maxRefreshDelay set to 14400000
> > 10:46:20.004 - DEBUG
> > [edu.internet2.middleware.shibboleth.wayf.IdPSiteSet:298] - Metadata
> > provider 'protnet' minRefreshDelay set to 300000
> > 10:46:20.004 - DEBUG
> > [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvide
> > r:253] - Beginning refresh of metadata from
> > 'http://www.protectnetwork.org/protectnetwork-metadata.xml'
> > 10:46:20.004 - DEBUG
> > [org.opensaml.saml2.metadata.provider.HTTPMetadataProvider:249] -
> > Attempting to fetch metadata document from
> > 'http://www.protectnetwork.org/protectnetwork-metadata.xml'
> > 10:46:20.051 - DEBUG
> > [org.opensaml.saml2.metadata.provider.HTTPMetadataProvider:334] -
> > Attempting to extract metadata from response to request for metadata
> > from 'http://www.protectnetwork.org/protectnetwork-metadata.xml'
> > 10:46:20.082 - DEBUG
> > [org.opensaml.saml2.metadata.provider.HTTPMetadataProvider:268] -
> > Successfully fetched 6008bytes of metadata from
> > http://www.protectnetwork.org/protectnetwork-metadata.xml
> > 10:46:20.082 - DEBUG
> > [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvide
> > r:260] - Processing new metadata from
> > 'http://www.protectnetwork.org/protectnetwork-metadata.xml'
> > 10:46:20.082 - DEBUG
> > [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvide
> > r:344] - Unmarshalling metadata from
> > 'http://www.protectnetwork.org/protectnetwork-metadata.xml'
> > 10:46:20.082 - DEBUG
> > [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvide
> > r:388] - Filtering metadata from
> > 'http://www.protectnetwork.org/protectnetwork-metadata.xml'
> > 10:46:20.082 - DEBUG
> > [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:490] -
> > Applying metadata filter
> > 10:46:20.082 - DEBUG
> > [org.opensaml.saml2.metadata.provider.MetadataFilterChain:54] -
> > Applying filter
> > edu.internet2.middleware.shibboleth.wayf.plugins.provider.BindingFilte
> > r
> > 10:46:20.082 - DEBUG
> > [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvide
> > r:397] - Releasing cached DOM for metadata from
> > 'http://www.protectnetwork.org/protectnetwork-metadata.xml'
> > 10:46:20.082 - DEBUG
> > [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvide
> > r:400] - Post-processing metadata from
> > 'http://www.protectnetwork.org/protectnetwork-metadata.xml'
> > 10:46:20.082 - DEBUG
> > [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvide
> > r:403] - Computing expiration time for metadata from
> > 'http://www.protectnetwork.org/protectnetwork-metadata.xml'
> > 10:46:20.082 - DEBUG
> > [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvide
> > r:406] - Expiration of metadata from
> > 'http://www.protectnetwork.org/protectnetwork-metadata.xml' will occur
> > at 2012-03-20T19:46:20.004Z
> > 10:46:20.082 - INFO
> > [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvide
> > r:423] - New metadata succesfully loaded for
> > 'http://www.protectnetwork.org/protectnetwork-metadata.xml'
> > 10:46:20.082 - INFO
> > [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvide
> > r:271] - Next refresh cycle for metadata provider
> > 'http://www.protectnetwork.org/protectnetwork-metadata.xml' will occur
> > on '2012-03-20T18:46:20.024Z' ('2012-03-20T13:46:20.024-05:00' local
> > time)
> >
> >
> > Then, on the actual request, again, everything looks fine:
> > 10:46:20.129 - INFO
> > [edu.internet2.middleware.shibboleth.wayf.WayfService:260] - DS
> > initialization completed.
> > 10:46:32.172 - INFO
> > [edu.internet2.middleware.shibboleth.wayf.WayfService:272] - Handling
> > DS request.
> > 10:46:32.187 - DEBUG
> > [edu.internet2.middleware.shibboleth.wayf.DiscoveryServiceHandler:585]
> > - Processing Idp Lookup for : https://mossext.utsystem.edu/shibboleth
> > 10:46:32.187 - DEBUG
> > [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:518] -
> > Searching for entity descriptor with an entity ID of
> > https://mossext.utsystem.edu/shibboleth
> > 10:46:32.187 - DEBUG
> > [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:518] -
> > Searching for entity descriptor with an entity ID of
> > https://mossext.utsystem.edu/shibboleth
> > 10:46:32.187 - DEBUG
> > [org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:518] -
> > Searching for entity descriptor with an entity ID of
> > https://mossext.utsystem.edu/shibboleth
> > 10:46:32.187 - DEBUG
> > [edu.internet2.middleware.shibboleth.wayf.DiscoveryServiceHandler:736]
> > - Displaying WAYF selection page.
> > 10:46:33.467 - INFO
> > [edu.internet2.middleware.shibboleth.wayf.WayfService:272] - Handling
> > DS request.
> >
> >
> >
> > > -----Original Message-----
> > > From: users-bounces at shibboleth.net [mailto:users-
> > > bounces at shibboleth.net] On Behalf Of Rod Widdowson
> > > Sent: Tuesday, March 20, 2012 10:45 AM
> > > To: 'Shib Users'
> > > Subject: RE: issue with CDS 1.2.0?
> > >
> > > > showUnusableIdPs="true" should take care of that, right?
> > > Absolutely..
> > >
> > > Are you using DS or WAYF protocol to approach the DS?  There
> > > shouldn't be a difference (modulo
> > > https://issues.shibboleth.net/jira/browse/SDSJ-102) which should not
> > > apply here since that IdP does have a shibboleth <SSO>.
> > >
> > > Is there anything interesting shown in the logs when you approach the DS?
> > >
> > >
> > >
> > > > -----Original Message-----
> > > > From: users-bounces at shibboleth.net
> > > > [mailto:users-bounces at shibboleth.net] On Behalf Of Caskey, Paul
> > > > Sent: 20 March 2012 15:34
> > > > To: Shib Users
> > > > Subject: RE: issue with CDS 1.2.0?
> > > >
> > > > showUnusableIdPs="true" should take care of that, right?
> > > > If so, I have that set for this DiscoveryServiceHandler.
> > > >
> > > > And, there are no metadata filters (yet).
> > > >
> > > > > -----Original Message-----
> > > > > From: users-bounces at shibboleth.net [mailto:users-
> > > > > bounces at shibboleth.net] On Behalf Of Chad La Joie
> > > > > Sent: Tuesday, March 20, 2012 10:15 AM
> > > > > To: Shib Users
> > > > > Subject: Re: issue with CDS 1.2.0?
> > > > >
> > > > > Is this a case of items being filtered out before being
> > > > > displayed as opposed to anything to do with the metadata itself?
> > > > >
> > > > > On 3/20/12 11:11 AM, Caskey, Paul wrote:
> > > > > > I tried deleting the existing spool file and it did download a
> > > > > > new file, but still
> > > > > does not show up in the DS.
> > > > > >
> > > > > > Here's the log:
> > > > > > 10:02:36.441 - INFO
> > > > >
> > > [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvi
> > > > > de r:423] - New metadata succesfully loaded for
> > > > > 'http://www.protectnetwork.org/protectnetwork-metadata.xml'
> > > > > >
> > > > > > 10:02:36.441 - INFO
> > > > > >
> > > > >
> > > [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvi
> > > > > de
> > > > > > r:271] - Next refresh cycle for metadata provider
> > > > > > 'http://www.protectnetwork.org/protectnetwork-metadata.xml'
> > > > > > will occur on '2012-03-20T18:02:36.395Z' ('2012-03-20T13:02:36.395-05:00'
> > > > > > local
> > > > > > time)
> > > > > >
> > > > > > No WARN or ERROR messages in the log.
> > > > > >
> > > > > >
> > > > > >
> > > > > >
> > > > > >> -----Original Message-----
> > > > > >> From: users-bounces at shibboleth.net [mailto:users-
> > > > > >> bounces at shibboleth.net] On Behalf Of Rod Widdowson
> > > > > >> Sent: Tuesday, March 20, 2012 5:08 AM
> > > > > >> To: 'Shib Users'
> > > > > >> Subject: RE: issue with CDS 1.2.0?
> > > > > >>
> > > > > >> Paul,
> > > > > >>
> > > > > >> A major motivation point of the 1.1.3-> 1.2 upgrade was that
> > > > > >> no configuration change should be needed; but that you could
> > > > > >> make changes to take advantage of all the new options if you wanted.
> > > > > >> So if something is needed, well that would be a bug.
> > > > > >>
> > > > > >> I've not been able to reproduce this locally, so I'm not sure
> > > > > >> what to
> > > > > suggest.
> > > > > >> AFAICS you are correctly configured.
> > > > > >>
> > > > > >> I know you'll have checked the logs at debug so I won't
> > > > > >> offend you by
> > > > > asking.
> > > > > >> Have you tried deleting the spool file
> > > > > >> (/opt/shibboleth-ds/metadata/protectnetwork-metadata.xml)
> > > > > >> just in case that is implicated?
> > > > > >>
> > > > > >> /Rod
> > > > > >>
> > > > > >>
> > > > > >>> -----Original Message-----
> > > > > >>> From: users-bounces at shibboleth.net
> > > > > >>> [mailto:users-bounces at shibboleth.net] On Behalf Of Caskey,
> > > > > >>> Paul
> > > > > >>> Sent: 19 March 2012 21:28
> > > > > >>> To: users at shibboleth.net
> > > > > >>> Subject: issue with CDS 1.2.0?
> > > > > >>>
> > > > > >>> I'm having trouble getting the new DS to use a metadata
> > > > > >>> source in my config which contains only one entry.  This has
> > > > > >>> been in the config for years and only 1.2.0 is having a
> > > > > >>> problem (identical config in
> > > > > >>> 1.1.3 works as expected).
> > > > > >>>
> > > > > >>> For example, we have a categorized (list of lists=true) DS
> > > > > >>> which lists protectnetwork.org as its own "federation" in
> > > > > >>> the left side text
> > > box.
> > > > > >>>
> > > > > >>> Upgrading an existing CDS from 1.1.3 to 1.2.0 makes
> > > > > >>> protectnetwork disappear from the CDS page (no changes were
> > > made
> > > > > >>> to wayfconfig.xml during the upgrade).  I've tried enclosing
> > > > > >>> their metadata in an EntitiesDescriptor, but that didn't help.
> > > > > >>> I can put their entity metadata into
> > > > > >> either fed1 or fed2 metadata and it shows up in the list just fine.
> > > > > >>>
> > > > > >>> Here's the relevant config (fed1 and fed2 are listed in the
> > > > > >>> CDS, while
> > > > > >> protectnetwork is not):
> > > > > >>>
> > > > > >>
> > > > > >>
> > > > > >> [Snip]
> > > > > >>
> > > > > >> --
> > > > > >> To unsubscribe from this list send an email to users-
> > > > > >> unsubscribe at shibboleth.net
> > > > > > --
> > > > > > To unsubscribe from this list send an email to
> > > > > > users-unsubscribe at shibboleth.net
> > > > > --
> > > > > To unsubscribe from this list send an email to users-
> > > > > unsubscribe at shibboleth.net
> > > > --
> > > > To unsubscribe from this list send an email to
> > > > users-unsubscribe at shibboleth.net
> > >
> > > --
> > > To unsubscribe from this list send an email to users-
> > > unsubscribe at shibboleth.net
> > --
> > To unsubscribe from this list send an email to users-
> > unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net