IdP Metadata Cache

[Cantor, Scott]

On 6/19/14, 9:46 AM, "Jeff Masiello" <jmasiello at actionet.com> wrote:

>I¹ve been reading the Shibboleth Wiki quite a bit and don¹t mind being
>pointed to specific information. I¹ve recently inherited a legacy setup.
>If I understand the terms it is a federation. We have an IdP and several
>SP¹s out there that connect to it.

A federation is generally understood to be something more comprehensive
than just collections of systems, but regardless if you're managing
metadata for a set of parties, that's more or less a federation.

> 
>My questions:
>When I add a new set of metadata from an SP, it sometimes takes quite a
>while to get included into the current IdP cache set. I¹m not sure if I¹m
>using the proper terminology but on the IdP we have a
>federation-metadata.xml file that has all the metadata from all the SP¹s
>in it. We will manually add a new Entity Descriptor to that file. It
>sometimes takes up to 12 hours to become active.

Then you must have a very long refresh delay on the metadata source. The
logs will tell you when it's going to refresh next.

> Our config on the IdP has about a 5 minute refresh time (I think) so I¹m
>not sure what to do.

I don't know what config you mean, but there's no way that's true.
Reloading the relying-party.xml components every 5 minutes, while a bad
idea, would also reload all metadata sources.

>Is there a way to force a complete refresh? We have a development
>environment as well and have tried actually restarting shibd on the IdP
>but when we go to the SP and log in we still get an error. Come back the
>next morning and it works.

There is no such thing, shibd is an SP component.

-- Scott