Outbound HTTP proxy for metadata updates

[Matthew Slowe]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

I've been trying to get our v3 IDP to use an upstream HTTP proxy to make
the outbound request but it seems to be ignoring me and going direct :-(

My settings in relying-party.xml:

<MetadataProvider id="URLMD" xsi:type="FileBackedHTTPMetadataProvider"
                   xmlns="urn:mace:shibboleth:2.0:metadata"
                   metadataURL="http://metadata.ukfederation.org.uk/ukfederation-metadata.xml"
                   proxyHost="advocate.kent.ac.uk"
                   proxyPort="3128"
                   backingFile="%{idp.home}/metadata/ukfederation-metadata.xml">
    <MetadataFilter xsi:type="ChainingFilter" xmlns="urn:mace:shibboleth:2.0:metadata">
        <MetadataFilter xsi:type="RequiredValidUntil" xmlns="urn:mace:shibboleth:2.0:metadata"
            maxValidityInterval="2592000" />
        <MetadataFilter xsi:type="SignatureValidation" xmlns="urn:mace:shibboleth:2.0:metadata"
            trustEngineRef="shibboleth.MetadataTrustEngine"
            requireSignedMetadata="true" />

        <MetadataFilter xsi:type="EntityRoleWhiteList" xmlns="urn:mace:shibboleth:2.0:metadata">
            <RetainedRole>samlmd:SPSSODescriptor</RetainedRole>
        </MetadataFilter>

    </MetadataFilter>
</MetadataProvider>

Is this the correct place to be doing this? Is there some other switch to tickle to enable this?

Ta,
- -- 
Matthew Slowe | Server Infrastructure Officer
IT Infrastructure, Information Services, University of Kent
Room S21, Cornwallis South
Canterbury, Kent, CT2 7NZ, UK
Tel: +44 (0)1227 824265 

www.kent.ac.uk/is | @UnikentUnseenIT | @UKCLibraryIt
PGP: https://keybase.io/fooflington
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)

iEYEARECAAYFAlept9kACgkQ/V1qDCaTXgdDaQCg0RD917IudAwWxZVAQiEiA0If
jGAAnjaqK4WV3EoO2YLspqngkO67BrFr
=BoxB
-----END PGP SIGNATURE-----