Metadata expiry and computing a new expiration time.

[Alex Stuart]

Hi Simon

It's Alex from the UK federation support team here. Looks like this
might be a UK federation-specific issue, so I'll reply to you off-list.

Alex


On 11/09/2015 09:46, Simon Fraser wrote:
> 
> We recently upgraded our identity provider from 2.x to 3.1.1 (it took a
> while to get working, which is why we're not yet on 3.1.2). We are
> encountering a metadata expiry problem, and I'd like some advice.
> 
> We are part of the JANET UK Federation, and successfully retrieve their
> metadata[1]
> 
> 
> However, users can't log in to sites that are part of the federation, as
> the metadata has expired:
> 
> 2015-09-11 09:41:22,483 - DEBUG
> [org.opensaml.saml.metadata.resolver.impl.BasicRoleDescriptorResolver:198]
> - Metadata document did not contain a descriptor for entity
> https://sp.eblib.com/shibboleth
> 
> Resulting in the idp displaying the error "The application you have
> accessed is not registered for use with this service."
> 
> 
>    <MetadataProvider id="UKFederationMetadata"
>                       xsi:type="FileBackedHTTPMetadataProvider"
> 
> backingFile="%{idp.home}/metadata/ukfederation-metadata.xml"
> 
> metadataURL="http://metadata.ukfederation.org.uk/ukfederation-metadata.xml">
> 
>     </MetadataProvider>
> 
> The backing file has not been changed since August 24th, and the expiry
> date in the top says its expiry time has passed, so I think the error
> the users are getting is correct, and that is is the metadata refresh
> that is not working as expected.
> 
> 
> What can I do to make sure the metadata is refreshed?
> 
> Simon.
> 
> 
> 
> [1] idp-process.log, record of updating uk federation metadata
> 
> 2015-09-11 09:39:27,747 - DEBUG
> [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:283]
> - Beginning refresh of metadata from
> 'http://metadata.ukfederation.org.uk/ukfederation-metadata.xml'
> 2015-09-11 09:39:27,747 - DEBUG
> [org.opensaml.saml.metadata.resolver.impl.HTTPMetadataResolver:225] -
> Attempting to fetch metadata document from
> 'http://metadata.ukfederation.org.uk/ukfederation-metadata.xml'
> 2015-09-11 09:39:27,794 - DEBUG
> [org.opensaml.saml.metadata.resolver.impl.HTTPMetadataResolver:231] -
> Metadata document from
> 'http://metadata.ukfederation.org.uk/ukfederation-metadata.xml' has not
> changed since last retrieval
> 2015-09-11 09:39:27,794 - DEBUG
> [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:287]
> - Metadata from
> 'http://metadata.ukfederation.org.uk/ukfederation-metadata.xml' has not
> changed since last refresh
> 2015-09-11 09:39:27,794 - DEBUG
> [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:357]
> - Computing new expiration time for cached metadata from
> 'http://metadata.ukfederation.org.uk/ukfederation-metadata.xml
> 2015-09-11 09:39:27,944 - INFO
> [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:306]
> - Next refresh cycle for metadata provider
> 'http://metadata.ukfederation.org.uk/ukfederation-metadata.xml' will
> occur on '2015-09-11T08:44:27.943Z' ('2015-09-11T09:44:27.943+01:00'
> local time)
> 
> 
> 

-- 
Alex Stuart
Team Leader - Federated Access Management
EDINA, University of Edinburgh

The University of Edinburgh is a charitable body, registered in
Scotland, with registration number SC005336.