IdP Metadata Cache

[Jeff Masiello]

First, thanks for the rapid response.

1. by metadata source do you mean the metadata xml file on the IdP or is there a refresh time option on the metadata EntityDescriptor for a given SP? If the latter than it hasn't been set (which wouldn't surprise me) However in looging in the idp-process.log (there are a LOT of lines in there) I found this
13:56:45.527 - INFO [org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider:238] - Metadata from '/opt/shibboleth-idp/metadata/54_241_48_11.xml' unchanged since last refresh, next refresh will occur at approximately 2014-06-19T14:04:15.526Z
I need to figure out whywe are using that one.

2. Again, probably my newness...There are a few of these in relying party.
<metadata:MetadataProvider id="nwtp_old_sp" maxRefreshDelay="PT10M0.000S" metadataFile="/opt/shibboleth-idp/metadata/50_18_137_16.xml" minRefreshDelay="PT5M0.000S" xsi:type="metadata:FilesystemMetadataProvider"/>

I kind of thought 5 minutes was a bad idea but as I'm still learning I can't make a recommendation until I'm more solid on our use cases.

3. erg? I thought shibd was the shibboleth program. It's only on the SP and not the IdP? What would I restart on the IdP? Maybe I missed this page in the Wiki.

Sorry for my newness.

Jeff Masiello


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, June 19, 2014 9:50 AM
To: Shib Users
Subject: Re: IdP Metadata Cache

On 6/19/14, 9:46 AM, "Jeff Masiello" <jmasiello at actionet.com> wrote:

>I¹ve been reading the Shibboleth Wiki quite a bit and don¹t mind being 
>pointed to specific information. I¹ve recently inherited a legacy setup.
>If I understand the terms it is a federation. We have an IdP and 
>several SP¹s out there that connect to it.

A federation is generally understood to be something more comprehensive than just collections of systems, but regardless if you're managing metadata for a set of parties, that's more or less a federation.

> 
>My questions:
>When I add a new set of metadata from an SP, it sometimes takes quite a 
>while to get included into the current IdP cache set. I¹m not sure if 
>I¹m using the proper terminology but on the IdP we have a 
>federation-metadata.xml file that has all the metadata from all the 
>SP¹s in it. We will manually add a new Entity Descriptor to that file. 
>It sometimes takes up to 12 hours to become active.

Then you must have a very long refresh delay on the metadata source. The logs will tell you when it's going to refresh next.

> Our config on the IdP has about a 5 minute refresh time (I think) so 
>I¹m not sure what to do.

I don't know what config you mean, but there's no way that's true.
Reloading the relying-party.xml components every 5 minutes, while a bad idea, would also reload all metadata sources.

>Is there a way to force a complete refresh? We have a development 
>environment as well and have tried actually restarting shibd on the IdP 
>but when we go to the SP and log in we still get an error. Come back 
>the next morning and it works.

There is no such thing, shibd is an SP component.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net