Keep the Shib IdP running if there are some issues in relying-party.xml file

[Yaowen Tu]

Thanks. I am just trying to see how IdP could handle these error cases, I
don't want IdP to be down if only one SP metadata file is not accessible.
In production, everything could happen.

I see some documents in
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPMetadataProvider.

I tried the following scenario:
1. Config relying-party.xml like this:


<metadata:MetadataProvider id="SP" minRefreshDelay="PT1M"
maxRefreshDelay="PT2M" metadataFile="E:\metadata.xml"
xsi:type="metadata:FilesystemMetadataProvider"/>

2. Restart IdP
3. Everything works well now
4. I manually deleted E:\metadata.xml file
5. Based on the wiki, I am expecting the IdP to refresh the cache in max 2
minutes.
6. But after 5 minutes, I still don't see any error, IdP still return
correct response.

Did it miss anything?

Yaowen


On Tue, Mar 19, 2013 at 4:44 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 3/19/13 6:58 PM, "Yaowen Tu" <yaowen.tu at gmail.com> wrote:
> >
> >Based on my experiment, If the metadata file does not exist, the whole
> >IdP won't work.
>
> Why would you define a metadata source that didn't exist? The more common
> case is avoiding failure due to the file being invalid for whatever reason.
>
> >Is there a setting some where to tell the IdP to skip the the SPs whose
> >metadata file or URL is not accessible?
>
> They have a failFast setting that can be disabled. I can't recall the
> exact spelling or wording, should be in the docs. In which case I'd ask
> what you searched on so that I can fix the docs to make it more findable.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130319/2f8ea15d/attachment.html