Auto Configuration Reloading Test Case for IDP

[Joshua Riffle]

Picture didn't seem to show for the Service Provider example so here it is
(again?):
[image: Inline image 1]


Joshua Riffle
Software Engineer
*Azusa Pacific University*


On Wed, Jan 22, 2014 at 4:31 PM, Joshua Riffle <jriffle at apu.edu> wrote:

> So I have been testing scenarios for applying configuration changes to an
> Identity Provider using the automatic configuration reloading (in
> service.xml) on relying-party.xml specifically. In my use-case I tried
> momentarily commenting out a vanilla Shibboleth Service Provider that I use
> for testing.
>
> Before:
> <metadata:MetadataProvider id="SPNONPROD"
> xsi:type="metadata:FileBackedHTTPMetadataProvider"
> metadataURL="http://idp-dev-01.devel.apu.edu/spnonprod-metadata.xml"
> backingFile="/opt/shibboleth/metadata/sp-url-metadata.xml">
> </metadata:MetadataProvider>
>
>
> After:
> <!--
> <metadata:MetadataProvider id="SPNONPROD"
> xsi:type="metadata:FileBackedHTTPMetadataProvider"
> metadataURL="http://idp-dev-01.devel.apu.edu/spnonprod-metadata.xml"
> backingFile="/opt/shibboleth/metadata/sp-url-metadata.xml">
> </metadata:MetadataProvider> -->
>
> No other changes.
>
> Before the change and the automatic reload (15 minutes) it allows me to
> login and see attributes from the Service Provider vantage point. After the
> change and the next automatic reload the Service Provider says there's no
> configured Service Provider with the entity ID in the request (as
> expected!).
>
> But... when I try to uncomment it and allow it to be automatically added
> back through configuration reloading. It appears to reload
> relying-party.xml successfully and the backed file sp-url-metadata.xml is
> populated with the correct information. However, the Identity Provider
> and the Service Provider both error out when I try to use the Service
> Provider:
>
> On the Service Provider (when accessing the secure folder):
>
>
> On the Identity Provider (when initiating the Service Provider):
> 16:23:07.950 - ERROR
> [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:923]
> - Could not resolve a key encryption credential for peer entity:
> https://sp.devel.apu.edu/shibboleth
> 16:23:07.951 - ERROR
> [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:289]
> - Unable to construct encrypter
> org.opensaml.xml.security.SecurityException: Could not resolve key
> encryption credential
>         at
> edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.getEncrypter(AbstractSAML2ProfileHandler.java:924)
> ~[shibboleth-identityprovider-2.3.6.jar:na]
>         at
> edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.buildResponse(AbstractSAML2ProfileHandler.java:286)
> ~[shibboleth-identityprovider-2.3.6.jar:na]
>         at
> edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.completeAuthenticationRequest(SSOProfileHandler.java:310)
> [shibboleth-identityprovider-2.3.6.jar:na]
>         at
> edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:177)
> [shibboleth-identityprovider-2.3.6.jar:na]
>         at
> edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:88)
> [shibboleth-identityprovider-2.3.6.jar:na]
>         at
> edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:84)
> [shibboleth-common-1.3.5.jar:na]
>         at javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
> [servlet-api.jar:na]
> ...elided...
>
> It "looks" like it's not fully reloading the Service Provider if (and only
> if) it is being added back again after existing previously. Is that
> expected behavior or am I missing something? I have tested a number of
> other surround scenarios and can elaborate if needed.
>
>
> Joshua Riffle
> Software Engineer
> *Azusa Pacific University*
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140122/31d12e80/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 31407 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20140122/31d12e80/attachment-0001.png