Metadata refresh downloads every time even though source not changing
shibboleth655 at lewenberg.com
shibboleth655 at lewenberg.com
Fri Dec 9 08:04:20 EST 2016
We are running Shibboleth IdP 3.2.1 and have two sources of metadata we
consume in the metadata_providers.xml file. One source is the InCommon
metadata while the other is locally-provided SP metadata. Both sources
are downloaded via a URL specified by a metadataURL attribute. In both
cases there is also a "backing file".
In the case of the InCommon metadata, the backing file only changes when
the data at the other end of the InCommon URL changes. In the case of
the local metadata, however, the backing file is changing *every* time
the IdP is scheduled to check for new metadata, even the if the data at
the other end of the URL has *not* changed.
This is unexpected and worrisome.
Here are the configurations:
<!-- InCommon -->
<MetadataProvider xmlns="urn:mace:shibboleth:2.0:metadata"
id="ICMD" xsi:type="FileBackedHTTPMetadataProvider"
metadataURL="http://md.incommon.org/InCommon/InCommon-metadata.xml"
backingFile="/var/tmp/InCommon-metadata.xml"
minRefreshDelay="PT1M" maxRefreshDelay="PT3M">
<MetadataFilter xsi:type="ChainingFilter">
<!-- Require metadata expiration at least monthly (28 days) -->
<MetadataFilter xsi:type="RequiredValidUntil"
maxValidityInterval="P28DT0H0M0.000S" />
<MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
certificateFile="${idp.home}/credentials/inc-md-cert.pem" />
<MetadataFilter xsi:type="EntityRoleWhiteList">
<RetainedRole>md:SPSSODescriptor</RetainedRole>
</MetadataFilter>
</MetadataFilter>
</MetadataProvider>
<!-- Local metadata -->
<MetadataProvider xsi:type="FileBackedHTTPMetadataProvider"
id="spdb-metadata" xmlns="urn:mace:shibboleth:2.0:metadata"
metadataURL="https://spdb.mysite.com/spmetadata/metadata.xml"
backingFile="/var/tmp/spdb-metadata.xml"
minRefreshDelay="PT1M" maxRefreshDelay="PT3M">
<MetadataFilter xsi:type="ChainingFilter">
<!-- Require metadata expiration at least monthly (28 days) -->
<MetadataFilter xsi:type="RequiredValidUntil"
maxValidityInterval="P28DT0H0M0.000S" />
</MetadataFilter>
</MetadataProvider>
More information about the users
mailing list