Metadata Issue

[Thomas Jones]

Good Afternoon Everyone.

I'm following shibs (IdP) and google docs in order to integrated these two
apps. It's working, but I'm worry about what the logs shows (entry
17:16:26.930 second line):


17:16:25.775 - DEBUG [org.apache.commons.httpclient.HttpMethodBase:1024] -
Resorting to protocol version default close connection policy
17:16:25.776 - DEBUG [org.apache.commons.httpclient.HttpMethodBase:1028] -
Should NOT close connection, using HTTP/1.1
17:16:25.777 - TRACE [org.apache.commons.httpclient.HttpConnection:874] -
enter HttpConnection.isResponseAvailable()
17:16:25.778 - TRACE [org.apache.commons.httpclient.HttpConnection:1174] -
enter HttpConnection.releaseConnection()
17:16:25.779 - DEBUG [org.apache.commons.httpclient.HttpConnection:1178] -
Releasing connection back to connection manager.
17:16:25.780 - TRACE
[org.apache.commons.httpclient.MultiThreadedHttpConnectionManager:630] -
enter HttpConnectionManager.releaseConnection(HttpConnection)
17:16:25.780 - DEBUG
[org.apache.commons.httpclient.MultiThreadedHttpConnectionManager:979] -
Freeing connection, hostConfig=HostConfiguration[host=http://localhost:8080]
17:16:25.781 - TRACE
[org.apache.commons.httpclient.MultiThreadedHttpConnectionManager:805] -
enter HttpConnectionManager.ConnectionPool.getHostPool(HostConfiguration)
17:16:25.782 - DEBUG
[org.apache.commons.httpclient.util.IdleConnectionHandler:76] - Adding
connection at: 1383171385782
17:16:25.783 - DEBUG
[org.apache.commons.httpclient.MultiThreadedHttpConnectionManager:961] -
Notifying no-one, there are no waiting threads
17:16:26.921 - TRACE
[edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:109] -
Attempting to retrieve IdP session cookie.
17:16:26.925 - TRACE
[edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:335] -
Looking up LoginContext with key 3a6e8e4b-6074-49a6-b953-897396ca501b from
StorageService parition: loginContexts
17:16:26.925 - TRACE
[edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:341] -
Retrieved LoginContext with key 3a6e8e4b-6074-49a6-b953-897396ca501b from
StorageService parition: loginContexts
17:16:26.928 - DEBUG
[org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:253] -
Checking child metadata provider for entity descriptor with entity ID:
google.com/a/mygoogledomain.com
17:16:26.929 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:518] -
Searching for entity descriptor with an entity ID of
google.com/a/mygoogledomain.com
17:16:26.930 - TRACE
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:531] -
Metadata root is an entity descriptor, checking if it's the one we're
looking for.
17:16:26.930 - TRACE
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:538] - Found
entity descriptor for entity with ID google.com/a/mygoogledomain.com but it
is no longer valid, skipping it.
17:16:26.931 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:167] -
Metadata document does not contain an EntityDescriptor with the ID
google.com/a/mygoogledomain.com
17:16:26.932 - DEBUG
[org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:253] -
Checking child metadata provider for entity descriptor with entity ID:
google.com/a/mygoogledomain.com
17:16:26.933 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:518] -
Searching for entity descriptor with an entity ID of
google.com/a/mygoogledomain.com
17:16:26.934 - TRACE
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:531] -
Metadata root is an entity descriptor, checking if it's the one we're
looking for.
17:16:26.934 - TRACE
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:538] - Found
entity descriptor for entity with ID google.com/a/mygoogledomain.com but it
is no longer valid, skipping it.
17:16:26.935 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:167] -
Metadata document does not contain an EntityDescriptor with the ID
google.com/a/mygoogledomain.com
17:16:26.936 - DEBUG
[org.opensaml.saml2.metadata.provider.ChainingMetadataProvider:253] -
Checking child metadata provider for entity descriptor with entity ID:
google.com/a/mygoogledomain.com
17:16:26.937 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:518] -
Searching for entity descriptor with an entity ID of
google.com/a/mygoogledomain.com
17:16:26.938 - TRACE
[org.opensaml.saml2.metadata.provider.AbstractMetadataProvider:522] -
Entity descriptor for the ID google.com/a/mygoogledomain.com was found in
index cache, returning
17:16:34.795 - TRACE
[edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:109] -
Attempting to retrieve IdP session cookie.
17:16:34.796 - TRACE
[edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:109] -
Attempting to retrieve IdP session cookie.
17:16:34.796 - TRACE
[edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:109] -
Attempting to retrieve IdP session cookie.
17:16:35.302 - TRACE
[edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:109] -
Attempting to retrieve IdP session cookie.
17:16:35.304 - TRACE
[edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:109] -
Attempting to retrieve IdP session cookie.
17:16:35.306 - TRACE
[edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:109] -
Attempting to retrieve IdP session cookie.
17:16:56.683 - TRACE
[edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:109] -
Attempting to retrieve IdP session cookie.

I've tried to add the attribute validUntil to my SP metadata but there's no
difference:


<?xml version="1.0" encoding="UTF-8"?>
<EntityDescriptor entityID="google.com/a/mygoogledomain.com"
xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
validUntil="2014-01-01T00:00:00Z">
    <SPSSODescriptor
protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

<NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
        <AssertionConsumerService index="1"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="
https://www.google.com/a/mygoogledomain.com/acs"/>
    </SPSSODescriptor>
</EntityDescriptor>



In my relyingparty I have:

.....

 <rp:RelyingParty id="google.com/a/mygoogledomain.com" provider="
http://190.85.66.110:10110/idp/shibboleth"
defaultSigningCredentialRef="IdPCredential">
        <rp:ProfileConfiguration xsi:type="saml:SAML2SSOProfile"
encryptAssertions="never" encryptNameIds="never"/>
    </rp:RelyingParty>

....

        <metadata:MetadataProvider id="mygoogledomain.com.id"
xsi:type="metadata:FilesystemMetadataProvider"
metadataFile="/opt/shibboleth-idp/metadata/mygoogledomaincom-metadata.xml"
        requireValidMetadata="false">
        </metadata:MetadataProvider>


I really want to eliminate the "Found entity descriptor for entity with ID
google.com/a/mygoogledomain.com but it is no longer valid, skipping it."
message is there an attribute that I need to add?

Do I need to change the values of *refreshDelayFactor, **minRefreshDelay
and **maxRefreshDelay *in order for the log to disappear*?*
*
*
Thanks!

Best,

Thomas
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131030/c5347ee8/attachment.html