Metadata refresh downloads every time even though source not changing

shibboleth655 at lewenberg.com shibboleth655 at lewenberg.com
Fri Dec 9 08:04:20 EST 2016


We are running Shibboleth IdP 3.2.1 and have two sources of metadata we 
consume in the metadata_providers.xml file. One source is the InCommon 
metadata while the other is locally-provided SP metadata. Both sources 
are downloaded via a URL specified by a metadataURL attribute. In both 
cases there is also a "backing file".

In the case of the InCommon metadata, the backing file only changes when 
the data at the other end of the InCommon URL changes. In the case of 
the local metadata, however, the backing file is changing *every* time 
the IdP is scheduled to check for new metadata, even the if the data at 
the other end of the URL has *not* changed.

This is unexpected and worrisome.

Here are the configurations:

<!-- InCommon -->
<MetadataProvider xmlns="urn:mace:shibboleth:2.0:metadata"
	id="ICMD" xsi:type="FileBackedHTTPMetadataProvider"
	metadataURL="http://md.incommon.org/InCommon/InCommon-metadata.xml"
	backingFile="/var/tmp/InCommon-metadata.xml"
	minRefreshDelay="PT1M" maxRefreshDelay="PT3M">
	<MetadataFilter xsi:type="ChainingFilter">
		<!-- Require metadata expiration at least monthly (28 days) -->
		<MetadataFilter xsi:type="RequiredValidUntil" 
maxValidityInterval="P28DT0H0M0.000S" />
		<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
		  certificateFile="${idp.home}/credentials/inc-md-cert.pem" />
		<MetadataFilter xsi:type="EntityRoleWhiteList">
			<RetainedRole>md:SPSSODescriptor</RetainedRole>
		</MetadataFilter>
	</MetadataFilter>
</MetadataProvider>

<!-- Local metadata -->
<MetadataProvider xsi:type="FileBackedHTTPMetadataProvider"
	id="spdb-metadata" xmlns="urn:mace:shibboleth:2.0:metadata"
	metadataURL="https://spdb.mysite.com/spmetadata/metadata.xml"
	backingFile="/var/tmp/spdb-metadata.xml"
	minRefreshDelay="PT1M" maxRefreshDelay="PT3M">
	<MetadataFilter xsi:type="ChainingFilter">
		<!-- Require metadata expiration at least monthly (28 days) -->
		<MetadataFilter xsi:type="RequiredValidUntil" 
maxValidityInterval="P28DT0H0M0.000S" />
	</MetadataFilter>
</MetadataProvider>




More information about the users mailing list