Shibboleth SP on RHEL7- issues between shibd <-> systemd?

[Jarno Huuskonen]

Hi,

On Mon, Jun 08, Ferenc Wagner wrote:
> "Cantor, Scott" <cantor.2 at osu.edu> writes:
> 
> > On 6/1/15, 10:04 AM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
> >
> > Well, if stopping doesn't work without that change, that's still new
> > information to me, I wasn't aware. That, I guess, suggests it's not
> > actually running the init script to stop it, it must be tracking the
> > PID inside that abomination and only stopping the forked process it
> > records.
> >
> > Same result for me, I'll add something to the systemd issue in Jira.
> 
> Could you please point me at this issue?  Systemd integration is
> something we'll have to tackle in the Debian packaging, too.

I've been using this shibd.service file with rhel7/centos7 and it
seems to work just fine. AFAIK with -F (shibd doesn't fork) the wait
timeout is ignored. So too short -w timeout shouldn't be a problem.
-----------------8<---------------
[Unit]
Description=Shibboleth Service Provider Daemon
Before=httpd.service

[Service]
Type=simple
User=shibd
ExecStart=/usr/sbin/shibd -c /etc/shibboleth/shibboleth2.xml -f -F
StandardInput=null
StandardOutput=null
StandardError=journal
TimeoutStopSec=5s
Restart=on-failure
RestartSec=10s
LimitNOFILE=2048

[Install]
WantedBy=multi-user.target
-----------------8<---------------

Also I'm using /etc/tmpfiles.d/shibd.conf:
-----------------8<---------------
# create shibd socket dir (man tmpfiles.d)
d /run/shibboleth 755 shibd shibd -
-----------------8<---------------

(NOTE: I'm not sure if /run/shibboleth matches the directory that shibd
uses by default (I'm using customized rpms/config)).

I think that systemd/shibd integration could be improved:
with systemd use SD_INFO / SD_ERR / SD_CRIT when writing errors(from
shibd.cpp) to stderr
(http://www.freedesktop.org/software/systemd/man/sd-daemon.html)
and
call sd_notify(0, "READY=1"); / sd_notify(0, "STOPPING=1"); when
starting / stopping
(http://www.freedesktop.org/software/systemd/man/sd_notify.html).
(with sd_notify READY=1, the shibd.service could use TimeoutStartSec=).

I can send a patch for this if this sounds reasonable ?

-Jarno

-- 
Jarno Huuskonen