IDPv3 really slow startup

Gavin Jackson gavinj at lesmills.net.au
Fri Oct 23 01:30:43 EDT 2015 

Thanks Tom (and Scott), 

We did write a custom attribute resolver (which may be causing the delay) - here is my attribute-filter.xml and attribute-resolver.xml config: 

Perhaps something may jump out! 

Kind Regards, 
Gavin Jackson 

attribute-filter.xml 

<?xml version="1.0" encoding="UTF-8"?> 
<afp:AttributeFilterPolicyGroup id="ShibbolethFilterPolicy" 
xmlns:afp="urn:mace:shibboleth:2.0:afp" xmlns:basic="urn:mace:shibboleth:2.0:afp:mf:basic" 
xmlns:saml="urn:mace:shibboleth:2.0:afp:mf:saml" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xsi:schemaLocation="urn:mace:shibboleth:2.0:afp classpath:/schema/shibboleth-2.0-afp.xsd 
urn:mace:shibboleth:2.0:afp:mf:basic classpath:/schema/shibboleth-2.0-afp-mf-basic.xsd 
urn:mace:shibboleth:2.0:afp:mf:saml classpath:/schema/shibboleth-2.0-afp-mf-saml.xsd"> 

<!-- Release the transient ID to anyone --> 
<afp:AttributeFilterPolicy id="releaseTransientIdToAnyone"> 
<afp:PolicyRequirementRule xsi:type="basic:ANY"/> 

<afp:AttributeRule attributeID="transientId"> 
<afp:PermitValueRule xsi:type="basic:ANY"/> 
</afp:AttributeRule> 

</afp:AttributeFilterPolicy> 

<afp:AttributeFilterPolicy id="releaseToAnyone" > 
<afp:PolicyRequirementRule xsi:type="basic:ANY"/> 

<afp:AttributeRule attributeID="uid"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

<afp:AttributeRule attributeID="custid"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

<afp:AttributeRule attributeID="title"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

<afp:AttributeRule attributeID="email"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

<afp:AttributeRule attributeID="commonName"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

<afp:AttributeRule attributeID="surname"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

<afp:AttributeRule attributeID="givenName"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

<afp:AttributeRule attributeID="isMemberOf"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

<afp:AttributeRule attributeID="roleValidLogin"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

<afp:AttributeRule attributeID="roleIsPerson"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

<afp:AttributeRule attributeID="roleIsInstructor"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

<afp:AttributeRule attributeID="roleIsInstructorAssessor"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

<afp:AttributeRule attributeID="roleIsInstructorTrainer"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

<afp:AttributeRule attributeID="roleIsInstructorPresenter"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

<afp:AttributeRule attributeID="roleIsLicensee"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

<afp:AttributeRule attributeID="roleHasActiveContracts"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

<afp:AttributeRule attributeID="roleIsGELCandidate"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

<afp:AttributeRule attributeID="roleIsGELTrained"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

<!-- Salesforce attributes --> 
<afp:AttributeRule attributeID="sfdcUser"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

<afp:AttributeRule attributeID="User.IsActive"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

<afp:AttributeRule attributeID="portal_id"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

<afp:AttributeRule attributeID="organization_id"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

<afp:AttributeRule attributeID="siteurl"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

<afp:AttributeRule attributeID="lmisalesforceid"> 
<afp:PermitValueRule xsi:type="basic:ANY" /> 
</afp:AttributeRule> 

</afp:AttributeFilterPolicy> 

</afp:AttributeFilterPolicyGroup> 

attribute-resolver.xml 

<?xml version="1.0" encoding="UTF-8"?> 
<resolver:AttributeResolver xmlns:resolver="urn:mace:shibboleth:2.0:resolver" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xmlns:pc="urn:mace:shibboleth:2.0:resolver:pc" xmlns:ad="urn:mace:shibboleth:2.0:resolver:ad" 
xmlns:dc="urn:mace:shibboleth:2.0:resolver:dc" xmlns:enc="urn:mace:shibboleth:2.0:attribute:encoder" 
xmlns:sec="urn:mace:shibboleth:2.0:security" 
xmlns:uid="urn:mace:lesmills.net.au:idp:resolver:dc" 
xsi:schemaLocation="urn:mace:shibboleth:2.0:resolver classpath:/schema/shibboleth-2.0-attribute-resolver.xsd 
urn:mace:shibboleth:2.0:resolver:pc classpath:/schema/shibboleth-2.0-attribute-resolver-pc.xsd 
urn:mace:shibboleth:2.0:resolver:ad classpath:/schema/shibboleth-2.0-attribute-resolver-ad.xsd 
urn:mace:shibboleth:2.0:resolver:dc classpath:/schema/shibboleth-2.0-attribute-resolver-dc.xsd 
urn:mace:shibboleth:2.0:attribute:encoder classpath:/schema/shibboleth-2.0-attribute-encoder.xsd 
urn:mace:shibboleth:2.0:security classpath:/schema/shibboleth-2.0-security.xsd 
urn:mace:lesmills.net.au:idp:resolver:dc classpath:/schema/zenkai-connector.xsd "> 

<!-- ========================================== --> 
<!-- Attribute Definitions --> 
<!-- ========================================== --> 

<!-- Schema: Core schema attributes--> 

<!-- Note that salesforce requires the uid to be encoded as unspecified --> 
<resolver:AttributeDefinition xsi:type="ad:Simple" id="uid" sourceAttributeID="uid"> 
<resolver:Dependency ref="zenkaiAttr" /> 
<resolver:AttributeEncoder xsi:type="SAML2StringNameID" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified" /> 
</resolver:AttributeDefinition> 

<resolver:AttributeDefinition xsi:type="ad:Simple" id="custid" sourceAttributeID="uid"> 
<resolver:Dependency ref="zenkaiAttr"/> 
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="custid" friendlyName="custid" /> 
</resolver:AttributeDefinition> 

<resolver:AttributeDefinition xsi:type="ad:Simple" id="email" sourceAttributeID="mail"> 
<resolver:Dependency ref="zenkaiAttr" /> 
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="mail" friendlyName="mail" /> 
</resolver:AttributeDefinition> 

<resolver:AttributeDefinition xsi:type="ad:Simple" id="title" sourceAttributeID="title"> 
<resolver:Dependency ref="zenkaiAttr" /> 
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="title" friendlyName="title" /> 
</resolver:AttributeDefinition> 

<resolver:AttributeDefinition xsi:type="ad:Simple" id="commonName" sourceAttributeID="cn"> 
<resolver:Dependency ref="zenkaiAttr" /> 
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="cn" friendlyName="cn" /> 
</resolver:AttributeDefinition> 

<resolver:AttributeDefinition xsi:type="ad:Simple" id="givenName" sourceAttributeID="fn"> 
<resolver:Dependency ref="zenkaiAttr" /> 
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="fn" friendlyName="givenName" /> 
</resolver:AttributeDefinition> 

<resolver:AttributeDefinition xsi:type="ad:Simple" id="surname" sourceAttributeID="sn"> 
<resolver:Dependency ref="zenkaiAttr" /> 
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="sn" friendlyName="sn"/> 
</resolver:AttributeDefinition> 

<resolver:AttributeDefinition xsi:type="ad:Simple" id="lmisalesforceid" sourceAttributeID="lmisalesforceid"> 
<resolver:Dependency ref="zenkaiAttr" /> 
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="lmisalesforceid" friendlyName="lmisalesforceid"/> 
</resolver:AttributeDefinition> 

<resolver:AttributeDefinition xsi:type="ad:Simple" id="roleValidLogin" sourceAttributeID="roleValidLogin"> 
<resolver:Dependency ref="zenkaiAttr" /> 
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="roleValidLogin" friendlyName="roleValidLogin"/> 
</resolver:AttributeDefinition> 

<resolver:AttributeDefinition xsi:type="ad:Simple" id="roleIsPerson" sourceAttributeID="roleIsPerson"> 
<resolver:Dependency ref="zenkaiAttr" /> 
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="roleIsPerson" friendlyName="roleIsPerson"/> 
</resolver:AttributeDefinition> 

<resolver:AttributeDefinition xsi:type="ad:Simple" id="roleIsInstructor" sourceAttributeID="roleIsInstructor"> 
<resolver:Dependency ref="zenkaiAttr" /> 
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="roleIsInstructor" friendlyName="roleIsInstructor"/> 
</resolver:AttributeDefinition> 

<resolver:AttributeDefinition xsi:type="ad:Simple" id="roleIsInstructorAssessor" sourceAttributeID="roleIsInstructorAssessor"> 
<resolver:Dependency ref="zenkaiAttr" /> 
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="roleIsInstructorAssessor" friendlyName="roleIsInstructorAssessor"/> 
</resolver:AttributeDefinition> 

<resolver:AttributeDefinition xsi:type="ad:Simple" id="roleIsInstructorTrainer" sourceAttributeID="roleIsInstructorTrainer"> 
<resolver:Dependency ref="zenkaiAttr" /> 
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="roleIsInstructorTrainer" friendlyName="roleIsInstructorTrainer"/> 
</resolver:AttributeDefinition> 

<resolver:AttributeDefinition xsi:type="ad:Simple" id="roleIsInstructorPresenter" sourceAttributeID="roleIsInstructorPresenter"> 
<resolver:Dependency ref="zenkaiAttr" /> 
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="roleIsInstructorPresenter" friendlyName="roleIsInstructorPresenter"/> 
</resolver:AttributeDefinition> 

<resolver:AttributeDefinition xsi:type="ad:Simple" id="roleIsLicensee" sourceAttributeID="roleIsLicensee"> 
<resolver:Dependency ref="zenkaiAttr" /> 
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="roleIsLicensee" friendlyName="roleIsLicensee"/> 
</resolver:AttributeDefinition> 

<resolver:AttributeDefinition xsi:type="ad:Simple" id="roleHasActiveContracts" sourceAttributeID="roleHasActiveContracts"> 
<resolver:Dependency ref="zenkaiAttr" /> 
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="roleHasActiveContracts" friendlyName="roleHasActiveContracts"/> 
</resolver:AttributeDefinition> 

<resolver:AttributeDefinition xsi:type="ad:Simple" id="roleIsGELCandidate" sourceAttributeID="roleIsGELCandidate"> 
<resolver:Dependency ref="zenkaiAttr" /> 
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="roleIsGELCandidate" friendlyName="roleIsGELCandidate"/> 
</resolver:AttributeDefinition> 

<resolver:AttributeDefinition xsi:type="ad:Simple" id="roleIsGELTrained" sourceAttributeID="roleIsGELTrained"> 
<resolver:Dependency ref="zenkaiAttr" /> 
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="roleIsGELTrained" friendlyName="roleIsGELTrained"/> 
</resolver:AttributeDefinition> 

<!-- User roles --> 
<resolver:AttributeDefinition xsi:type="ad:Simple" id="isMemberOf" sourceAttributeID="isMemberOf"> 
<resolver:Dependency ref="zenkaiAttr" /> 
<resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" name="isMemberOf" friendlyName="isMemberOf" /> 
</resolver:AttributeDefinition> 

<!-- Salesforce required attributes --> 
<resolver:DataConnector id="salesForceStaticAttributes" xsi:type="dc:Static" xmlns="urn:mace:shibboleth:2.0:resolver:dc"> 

<dc:Attribute id="User.IsActive"> 
<Value>1</Value> 
</dc:Attribute> 

<dc:Attribute id="portal_id"> 
<Value>06090000000HZ43</Value> 
</dc:Attribute> 

<dc:Attribute id="organization_id"> 
<Value>00DO0000000WVPL</Value> 
</dc:Attribute> 

<dc:Attribute id="siteurl"> 
<Value>https://uat-lesmills.cs5.force.com/digital</Value> 
</dc:Attribute> 

</resolver:DataConnector> 

<resolver:AttributeDefinition id="User.IsActive" xsi:type="ad:Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad"> 
<resolver:Dependency ref="salesForceStaticAttributes" /> 
<resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" name="User.IsActive" friendlyName="User.IsActive" /> 
</resolver:AttributeDefinition> 

<resolver:AttributeDefinition id="portal_id" xsi:type="ad:Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad"> 
<resolver:Dependency ref="salesForceStaticAttributes" /> 
<resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" name="portal_id" friendlyName="portal_id" /> 
</resolver:AttributeDefinition> 

<resolver:AttributeDefinition id="organization_id" xsi:type="ad:Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad"> 
<resolver:Dependency ref="salesForceStaticAttributes" /> 
<resolver:AttributeEncoder xsi:type="SAML2String" xmlns="urn:mace:shibboleth:2.0:attribute:encoder" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified" name="organization_id" friendlyName="organization_id" /> 
</resolver:AttributeDefinition> 

<resolver:AttributeDefinition id="siteurl" xsi:type="ad:Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad"> 
<resolver:Dependency ref="salesForceStaticAttributes" /> 
<resolver:AttributeEncoder xsi:type="enc:SAML2String" name="siteurl" friendlyName="siteurl"/> 
</resolver:AttributeDefinition> 

<resolver:DataConnector id="zenkaiAttr" xsi:type="ZenkaiLookup" xmlns="urn:mace:lesmills.net.au:idp:resolver:dc"/> 

<!-- ========================================== --> 
<!-- Principal Connectors --> 
<!-- ========================================== --> 
<resolver:PrincipalConnector xsi:type="pc:Transient" id="shibTransient" nameIDFormat="urn:mace:shibboleth:1.0:nameIdentifier"/> 
<resolver:PrincipalConnector xsi:type="pc:Transient" id="saml1Unspec" nameIDFormat="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/> 
<resolver:PrincipalConnector xsi:type="pc:Transient" id="saml2Transient" nameIDFormat="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/> 

</resolver:AttributeResolver> 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151023/ab580a00/attachment-0001.html>

More information about the users mailing list