Metadata fallback poorly?

[Ian Rifkin]

Hi,

Bizarre question. It was reported to me that I had a production shibboleth
IdP problem. Nothing changed with config on my end but I saw that it failed
even against sp.testshib.org. My non-prod Shib IdP was still working fine.

I looked into it and the metadata files that were configured to download
via a URL looked "odd". In fact they looked more like my IdP metadata file
(e.g. my entityID).

Looking through the logs there were some errors about downloading metadata
files -- which actually makes sense as I believe there was a campus network
connectivity issue. The log said it would fallback to using the previously
downloaded versions, which should have been fine. But somehow it looks to
have overwrote the metadata files with the IdP metadata.

We run Shib IdP 2.4.1 within Tomcat. Restarting Tomcat refreshed the
metadata files and everything is working again.

Any suggestions/insight?

Thanks,
Ian


-- 
Ian Rifkin '04, MS '09
Software Systems Manager
Library and Technology Services (LTS)
Brandeis University

http://go.brandeis.edu/u:irifkin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150308/0e1cd588/attachment.html