Clarification of failFastInitialization Metadata Option

[Mark K. Miller]

On Thu, 10 Mar 2016, Rising, Matt wrote:

> Recently we had a service provider whose MetadataProvider type is
> FileBackedHTTPMetadataProvider send us bad metadata-which caused the entire
> IdP to fail after a metadata reload.  Our natural question was "How do we
> prevent a single service provider from crashing the entire IDP?" which led
> us to the failFastInitialization=false option.

Scott already gave you the 'Shibboleth developer answer' to this question; 
I'll add the 'lowly IdP operator answer.'

I see your message signature shows you're at Towson University.  Your 
University belongs to the same _*trust*_ federation as mine does!  Had 
your administration committed to making the effort to help this service 
provider also participate in that same trust federation, I'm virtually 
positive this fiasco would have been avoided.

All the while vendors still don't see the value of joining our trust 
federation and many University administrations don't make any effort to 
help with that.

I'm sure this point will continue to be ignored just as it has been for 
over 10 years now.  Just sayin'...

Max


> However, the documentation on the option states "operations that require
> valid metadata will fail" and Scott notes in this thread
> (http://comments.gmane.org/gmane.comp.web.shibboleth.user/33630) that using
> the option will result in "your IdP will start up fine and then services
> will just fail to work randomly."
>
> 
> 
> This begs the question:  What is the failFastInitialization=false
> MetadataProvider option actually used for?  It seems as though it?s just a
> switch between ?fail now, massively? or ?fail later in a weird,
> less-diagnosable way.?  Testing the option on IdP V3 shows that the IdP does
> start, but then not even the /idp/status page will.
>
> 
> 
> So, not just operations for that service provider that provided bad metadata
> will fail, but any function that references metadata in any way will fail?
>
> 
> 
> Matt Rising
> 
> Towson University