Metadata expiry and computing a new expiration time.

[Simon Fraser]

On 13/09/15 18:46, Cantor, Scott wrote:
>
> Sarcasm? On whose part? You tell me something we know works and is completely mandatory to even consider using the software at all, but don't say why, and then I'm supposed to be able to help fix it?

I didn't go in more detail because it's not the immediate reason I was 
posting to the list.

I've added the verification based on the example in the config file:

     <MetadataProvider id="UKFederationMetadata"
                       xsi:type="FileBackedHTTPMetadataProvider"
 
backingFile="%{idp.home}/metadata/ukfederation-metadata.xml"
 
metadataURL="http://metadata.ukfederation.org.uk/ukfederation-metadata.xml">
         <MetadataFilter xsi:type="SignatureValidation"
             requireSignedMetadata="false">
             <PublicKey>
 
MIIDxzCCAq+gAwIBAgIJAOwuoY8tsvYGMA0GCSqGSIb3DQEBCwUAMHoxCzAJBgNV
 
BAYTAkdCMUMwQQYDVQQKDDpVSyBBY2Nlc3MgTWFuYWdlbWVudCBGZWRlcmF0aW9u
 
IGZvciBFZHVjYXRpb24gYW5kIFJlc2VhcmNoMSYwJAYDVQQDDB1VSyBGZWRlcmF0
 
aW9uIE1ldGFkYXRhIFNpZ25lcjAeFw0xNDA4MjYxMjIwMjhaFw0zNzEyMzExMjIw
 
MjhaMHoxCzAJBgNVBAYTAkdCMUMwQQYDVQQKDDpVSyBBY2Nlc3MgTWFuYWdlbWVu
 
dCBGZWRlcmF0aW9uIGZvciBFZHVjYXRpb24gYW5kIFJlc2VhcmNoMSYwJAYDVQQD
 
DB1VSyBGZWRlcmF0aW9uIE1ldGFkYXRhIFNpZ25lcjCCASIwDQYJKoZIhvcNAQEB
 
BQADggEPADCCAQoCggEBAOqtfMvCmBuQudC4/jZFPYkHDNHFyp1FA3KJihIUXppF
 
vrecrO2wG5CpyqB1mZ+MlKf4jKcTMGBIXC2klD+FyrEdJMBhO6vRmJnNphg3uNZM
 
ks0NqIaZmtgc7e8435nMhqLHV95UK2oCLcT4gZrTaXa2vt9kukTOijB0KqDIfEG5
 
369EHXPItApAEeMlHebbWndl5n2I16nya/LeaoiU9qJ6sVz4xd1UtUesewrmYVKg
 
PA2JYEpovmnr13sTnGssai5Db/FkrE2NJ4Q4drbPYcwincUo/UXzrtuPclr+l3JE
 
gjtvDzPrBxxvK0S/gARrbKz5tk4LDLkYsj4PKlwVS+UCAwEAAaNQME4wHQYDVR0O
 
BBYEFE9HhBuMxrzBYOj1Kj/3gtzAgtUEMB8GA1UdIwQYMBaAFE9HhBuMxrzBYOj1
 
Kj/3gtzAgtUEMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBALJkjT3K
 
QL3w3xNfVe27nEOY44K2AZiu4IhqmRSslcyMnhnxrovEhLL3ieKFXQ+QFIkzVdR5
 
BcO3NrSIz5V6b+mHtr5IjqLFHzOzzjw/3i8LddGOsApJiav+JrU1CGJXCU4cwYDN
 
hAyfuAlrrEEL2lWMU1L1ZTzHsG1yWTfukfuvTftY5BwZ/dgANgIWwLDhvL6CAQZ3
 
g5XteFPyChU0Z7b3XAHdVNHDa2VzWSsSUDtSQZ9DyTuqSjZH1q2/qtdMcrbJpdMB
 
cndOf1pZRLzb6a+akIYi//1qO48HpB4wouH9gS3ZER+rNBhVWu301UYxoVI7o8mG
                 Yq7dENJce7lO9yE=
             </PublicKey>
         </MetadataFilter>
         <MetadataFilter xsi:type="EntityRoleWhiteList">
             <RetainedRole>md:SPSSODescriptor</RetainedRole>
         </MetadataFilter>
     </MetadataProvider>



And the logs show this:

2015-09-14 09:49:38,397 - INFO 
[net.shibboleth.ext.spring.util.SchemaTypeAwareXMLBeanDefinitionReader:317] 
- Loading XML bean definitions from file 
[/opt/shibboleth-idp/system/conf/metadata-providers-system.xml]
2015-09-14 09:49:38,449 - INFO 
[net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:510] 
- Refreshing ApplicationContext:shibboleth.MetadataResolverService: 
startup date [Mon Sep 14 09:49:38 BST 2015]; parent: Root 
WebApplicationContext
2015-09-14 09:49:38,568 - WARN 
[net.shibboleth.ext.spring.context.FilesystemGenericApplicationContext:487] 
- Exception encountered during context initialization - cancelling 
refresh attempt
org.springframework.beans.factory.BeanCreationException: Error creating 
bean with name 
'org.opensaml.saml.metadata.resolver.filter.impl.SignatureValidationFilter#0': 
Cannot create inner bean '(inner bean)#659d4591' of type 
[org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine] 
while setting constructor argument; nested exception is 
org.springframework.beans.factory.BeanCreationException: Error creating 
bean with name '(inner bean)#659d4591': Cannot create inner bean '(inner 
bean)#384266b5' of type 
[org.opensaml.security.credential.impl.StaticCredentialResolver] while 
setting constructor argument; nested exception is 
org.springframework.beans.factory.BeanCreationException: Error creating 
bean with name '(inner bean)#384266b5': Cannot create inner bean '(inner 
bean)#f6511ee' of type 
[net.shibboleth.idp.profile.spring.relyingparty.security.credential.BasicInlineCredentialFactoryBean] 
while setting constructor argument; nested exception is 
org.springframework.beans.factory.BeanCreationException: Error creating 
bean with name '(inner bean)#f6511ee': Invocation of init method failed; 
nested exception is java.lang.IllegalArgumentException: Bad sequence size: 3
         at 
org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBean(BeanDefinitionValueResolver.java:313)
Caused by: org.springframework.beans.factory.BeanCreationException: 
Error creating bean with name '(inner bean)#659d4591': Cannot create 
inner bean '(inner bean)#384266b5' of type 
[org.opensaml.security.credential.impl.StaticCredentialResolver] while 
setting constructor argument; nested exception is 
org.springframework.beans.factory.BeanCreationException: Error creating 
bean with name '(inner bean)#384266b5': Cannot create inner bean '(inner 
bean)#f6511ee' of type 
[net.shibboleth.idp.profile.spring.relyingparty.security.credential.BasicInlineCredentialFactoryBean] 
while setting constructor argument; nested exception is 
org.springframework.beans.factory.BeanCreationException: Error creating 
bean with name '(inner bean)#f6511ee': Invocation of init method failed; 
nested exception is java.lang.IllegalArgumentException: Bad sequence size: 3
         at 
org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBean(BeanDefinitionValueResolver.java:313)
Caused by: org.springframework.beans.factory.BeanCreationException: 
Error creating bean with name '(inner bean)#384266b5': Cannot create 
inner bean '(inner bean)#f6511ee' of type 
[net.shibboleth.idp.profile.spring.relyingparty.security.credential.BasicInlineCredentialFactoryBean] 
while setting constructor argument; nested exception is 
org.springframework.beans.factory.BeanCreationException: Error creating 
bean with name '(inner bean)#f6511ee': Invocation of init method failed; 
nested exception is java.lang.IllegalArgumentException: Bad sequence size: 3
         at 
org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBean(BeanDefinitionValueResolver.java:313)
Caused by: org.springframework.beans.factory.BeanCreationException: 
Error creating bean with name '(inner bean)#f6511ee': Invocation of init 
method failed; nested exception is java.lang.IllegalArgumentException: 
Bad sequence size: 3
         at 
org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1566)
Caused by: java.lang.IllegalArgumentException: Bad sequence size: 3
         at 
org.bouncycastle.asn1.x509.SubjectPublicKeyInfo.<init>(Unknown Source)
2015-09-14 09:49:38,580 - ERROR 
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:181] 
- Service 'shibboleth.MetadataResolverService': Initial load failed
net.shibboleth.utilities.java.support.service.ServiceException: 
org.springframework.beans.factory.BeanCreationException: Error creating 
bean with name 
'org.opensaml.saml.metadata.resolver.filter.impl.SignatureValidationFilter#0': 
Cannot create inner bean '(inner bean)#659d4591' of type 
[org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine] 
while setting constructor argument; nested exception is 
org.springframework.beans.factory.BeanCreationException: Error creating 
bean with name '(inner bean)#659d4591': Cannot create inner bean '(inner 
bean)#384266b5' of type 
[org.opensaml.security.credential.impl.StaticCredentialResolver] while 
setting constructor argument; nested exception is 
org.springframework.beans.factory.BeanCreationException: Error creating 
bean with name '(inner bean)#384266b5': Cannot create inner bean '(inner 
bean)#f6511ee' of type 
[net.shibboleth.idp.profile.spring.relyingparty.security.credential.BasicInlineCredentialFactoryBean] 
while setting constructor argument; nested exception is 
org.springframework.beans.factory.BeanCreationException: Error creating 
bean with name '(inner bean)#f6511ee': Invocation of init method failed; 
nested exception is java.lang.IllegalArgumentException: Bad sequence size: 3
         at 
net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:334)
Caused by: org.springframework.beans.factory.BeanCreationException: 
Error creating bean with name 
'org.opensaml.saml.metadata.resolver.filter.impl.SignatureValidationFilter#0': 
Cannot create inner bean '(inner bean)#659d4591' of type 
[org.opensaml.xmlsec.signature.support.impl.ExplicitKeySignatureTrustEngine] 
while setting constructor argument; nested exception is 
org.springframework.beans.factory.BeanCreationException: Error creating 
bean with name '(inner bean)#659d4591': Cannot create inner bean '(inner 
bean)#384266b5' of type 
[org.opensaml.security.credential.impl.StaticCredentialResolver] while 
setting constructor argument; nested exception is 
org.springframework.beans.factory.BeanCreationException: Error creating 
bean with name '(inner bean)#384266b5': Cannot create inner bean '(inner 
bean)#f6511ee' of type 
[net.shibboleth.idp.profile.spring.relyingparty.security.credential.BasicInlineCredentialFactoryBean] 
while setting constructor argument; nested exception is 
org.springframework.beans.factory.BeanCreationException: Error creating 
bean with name '(inner bean)#f6511ee': Invocation of init method failed; 
nested exception is java.lang.IllegalArgumentException: Bad sequence size: 3
         at 
org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBean(BeanDefinitionValueResolver.java:313)
Caused by: org.springframework.beans.factory.BeanCreationException: 
Error creating bean with name '(inner bean)#659d4591': Cannot create 
inner bean '(inner bean)#384266b5' of type 
[org.opensaml.security.credential.impl.StaticCredentialResolver] while 
setting constructor argument; nested exception is 
org.springframework.beans.factory.BeanCreationException: Error creating 
bean with name '(inner bean)#384266b5': Cannot create inner bean '(inner 
bean)#f6511ee' of type 
[net.shibboleth.idp.profile.spring.relyingparty.security.credential.BasicInlineCredentialFactoryBean] 
while setting constructor argument; nested exception is 
org.springframework.beans.factory.BeanCreationException: Error creating 
bean with name '(inner bean)#f6511ee': Invocation of init method failed; 
nested exception is java.lang.IllegalArgumentException: Bad sequence size: 3
         at 
org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBean(BeanDefinitionValueResolver.java:313)
Caused by: org.springframework.beans.factory.BeanCreationException: 
Error creating bean with name '(inner bean)#384266b5': Cannot create 
inner bean '(inner bean)#f6511ee' of type 
[net.shibboleth.idp.profile.spring.relyingparty.security.credential.BasicInlineCredentialFactoryBean] 
while setting constructor argument; nested exception is 
org.springframework.beans.factory.BeanCreationException: Error creating 
bean with name '(inner bean)#f6511ee': Invocation of init method failed; 
nested exception is java.lang.IllegalArgumentException: Bad sequence size: 3
         at 
org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBean(BeanDefinitionValueResolver.java:313)
Caused by: org.springframework.beans.factory.BeanCreationException: 
Error creating bean with name '(inner bean)#f6511ee': Invocation of init 
method failed; nested exception is java.lang.IllegalArgumentException: 
Bad sequence size: 3
         at 
org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1566)
Caused by: java.lang.IllegalArgumentException: Bad sequence size: 3
         at 
org.bouncycastle.asn1.x509.SubjectPublicKeyInfo.<init>(Unknown Source)
2015-09-14 09:49:38,581 - ERROR 
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:185] 
- Service 'shibboleth.MetadataResolverService': No further attempts will 
be made to reload


-- 
 The Wellcome Trust Sanger Institute is operated by Genome Research 
 Limited, a charity registered in England with number 1021457 and a 
 company registered in England with number 2742969, whose registered 
 office is 215 Euston Road, London, NW1 2BE.