InCommon metadata problem now fixed - how to detect in the future

[Tom Scavo]

On Wed, Feb 25, 2015 at 2:22 PM, Clayton <upnyhgb8v6 at snkmail.com> wrote:
>
> This morning I got a call from our Help Desk telling me that there were Shib
> SSO errors.  Eventually I figured out that the problem was only with the SPs
> which are part of the InCommon federation.  About the time I was coming to
> this conclusion and finding that I was having a difficult time downloading
> the HTTP-file-backed metadata file from InCommon, the problem cleared up.  I
> think they fixed it on their end (by switching to a "fall back" server or
> file).

That's probably the wrong conclusion but let's hold that thought as we
try to get to the bottom of this.

If you manage an IdP in the InCommon Federation but you're NOT a
Federation Site Administrator, you probably want to subscribe to the
inc-ops-notifications mailing list:

https://lists.incommon.org/sympa/info/inc-ops-notifications

All Federation Site Administrators are automatically subscribed to
this list but it's an open subscription list so...

> Specifically we started seeing symptoms b/c of this first line in the
> InCommon metadata file:
>
>         <Entitiesdescriptor ...  validuntil="2015-02-25t10:00:00z" ...

That implies your metadata refresh process has been broken for two
weeks since the InCommon metadata file has a two-week expiration
window.

> The error has been in the log file for a while:

Two weeks, right?

>         Error
> [org.Opensaml.Saml2.Metadata.Provider.Httpmetadataprovider:262] - error
> retrieving metadata from ...

>From what location? Exactly what location are you requesting?

My guess is that your IdP is requesting metadata at the following location:

http://md.incommon.org/InCommon/InCommon-metadata.xml

which is what it should be doing but exactly two weeks ago we
introduced the MD-RPI schema into production metadata and I'll bet
that broke your metadata refresh process somehow. Something you did
today must have brought it back to life.

> Is there anything I can do to be alerted to this kind of thing?
> I suppose I could have a script grep through the log file every 5 minutes
> for new errors and send me an email when they're found.
> But is there something more elegant?

That's a Shibboleth question that I can't answer, maybe someone else
has a suggestion?

Tom