Shibboleth SP on RHEL7- issues between shibd <-> systemd?

[Jarno Huuskonen]

Hi,

On Mon, Jun 08, Cantor, Scott wrote:
> On 6/8/15, 4:15 AM, "users on behalf of Jarno Huuskonen" <users-bounces at shibboleth.net on behalf of jarno.huuskonen at uef.fi> wrote:
> 
> >I've been using this shibd.service file with rhel7/centos7 and it
> >seems to work just fine. AFAIK with -F (shibd doesn't fork) the wait
> >timeout is ignored. So too short -w timeout shouldn't be a problem.
> 
> I don't think that's ideal for the reasons already noted. shibd used to operate that way and it was changed pretty deliberately.

Ok thanks for clarifying this.
Is InCommon/edugain metadata good example of metadata that takes a long time
to load/process (and needs long -w time) ?
(Quick testing when I add both InCommon/Edugain metadata it takes about
+75s from shibd start to listener->run).

> >I think that systemd/shibd integration could be improved:
> >with systemd use SD_INFO / SD_ERR / SD_CRIT when writing errors(from
> >shibd.cpp) to stderr
> >(http://www.freedesktop.org/software/systemd/man/sd-daemon.html)
> >and
> >call sd_notify(0, "READY=1"); / sd_notify(0, "STOPPING=1"); when
> >starting / stopping
> >(http://www.freedesktop.org/software/systemd/man/sd_notify.html).
> >(with sd_notify READY=1, the shibd.service could use TimeoutStartSec=).
> 
> Well, conditionally I suppose. There are too many platforms without it and hopefully this is all temporary and somebody regains their sanity.

Does that mean you're not a systemd fan :) ?

Is shibd ready to process requests when it calls
listener->run(&shibd_shutdown) (shibd.cpp:L442) ? (With forking shibd
signals parent with SIGUSR1 just before listener->run).

Quick test with shibd.service Type=notify and TimeoutStartSec=x
seems to work if I call sd_notify(0, "READY=1"); just before
listener->run.

If calling sd_notify(0, "READY=1") just before listener->run is ok, then
I can try to create a small patch (with autoconf: --enable-systemd).

-Jarno

-- 
Jarno Huuskonen