Metadata expiry and computing a new expiration time.

[Tom Scavo]

On Fri, Sep 11, 2015 at 4:46 AM, Simon Fraser <srf at sanger.ac.uk> wrote:
>
> We recently upgraded our identity provider from 2.x to 3.1.1 (it took a
> while to get working, which is why we're not yet on 3.1.2). We are
> encountering a metadata expiry problem, and I'd like some advice.

For the archives, can you tell us what version of Shibboleth was
involved? Is it V3.1.1 or V2? If the latter, can you be more specific?

(Just yesterday we responded to a similar issue with Shib IdP V2.3.8.)

> users can't log in to sites that are part of the federation, as the
> metadata has expired:
>
> 2015-09-11 09:41:22,483 - DEBUG
> [org.opensaml.saml.metadata.resolver.impl.BasicRoleDescriptorResolver:198] -
> Metadata document did not contain a descriptor for entity
> https://sp.eblib.com/shibboleth
>
> Resulting in the idp displaying the error "The application you have accessed
> is not registered for use with this service."
>
>    <MetadataProvider id="UKFederationMetadata"
>                       xsi:type="FileBackedHTTPMetadataProvider"
>
> backingFile="%{idp.home}/metadata/ukfederation-metadata.xml"
>
> metadataURL="http://metadata.ukfederation.org.uk/ukfederation-metadata.xml">
>     </MetadataProvider>

Btw, that configuration is completely insecure since it does not
verify the signature on the metadata.

> The backing file has not been changed since August 24th, and the expiry date
> in the top says its expiry time has passed, so I think the error the users
> are getting is correct, and that is is the metadata refresh that is not
> working as expected.

This looks very similar to an issue report we received in the InCommon
Federation yesterday. Both the MetadataProvider and the reported
behavior are nearly identical.

> What can I do to make sure the metadata is refreshed?

I wish I knew the answer to that question.

Tom