native.log permission errors (SP 2.5)

[Cantor, Scott]

> We've been seeing some somewhat confusing errors from our Shibboleth
> SPs, and am not quite sure how best to resolve them.

Don't ever configure logging in shibboleth2.xml, or you will have to change the permissions in the filesystem because it will reload the logging settings every time it reloads the configuration, by which time mod_shib is not root.

> The upgrade notes suggest that with 2.5 perhaps the above logger
> configuration (and its associated OutOfProcess element) could be
> discarded *or* file permissions changed, but I'm a bit confused because
> clearly shib is managing to log to both the log files mentioned in the
> native.logger configuration file, despite complaining about permissions.

No, it's doing it once and then every time after it can't.

Either change the permissions away from root or stop setting the logger property.

-- Scott