Error loading metadata file

[Lipscomb, Gary]

Hi all,

I deliberately mistyped the URL required to get the metadata from the Australian Access Federation (AAF) to test some code changes on our login page assuming shibboleth would pick up the existing metadata file on disk.

When I go to access one of the AAF sites I get the error message [2] "The application you have accessed is not registered for use with this service".

Looking back in the logs [3] I see that the backup file is not loaded.
            "Problem reading metadata from remote source; detected existing cached metadata, skipping load of backup file"
The metadata-providers.xml [3] segment is shown. Is this expected behaviour or have I missed a configuration setting.

Regards

Gary



[1] metadata-providers.xml

  <!-- Federation metadata -->
  <MetadataProvider id="FederationMetadata"
    xsi:type="FileBackedHTTPMetadataProvider"
    refreshDelayFactor="0.125"
    maxRefreshDelay="PT2H"
    httpCaching="memory"
    backingFile="%{idp.home}/metadata/aaf-metadata.xml"
    metadataURL="%{aaf.metadata.url}">

    <MetadataFilter xsi:type="ChainingFilter">
      <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P30D" />

      <MetadataFilter xsi:type="SignatureValidation"
        certificateFile="%{idp.home}/credentials/aaf-metadata-cert.pem"
        requireSignedRoot="true">
      </MetadataFilter>
    </MetadataFilter>

    <MetadataFilter xsi:type="EntityRoleWhiteList">
      <RetainedRole>md:SPSSODescriptor</RetainedRole>
    </MetadataFilter>
  </MetadataProvider>

[2] idp-process.log - no metadata returned

2017-06-05 11:56:04,173 - INFO [org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler:128] - Message Handler:  No metadata returned for https://manager.test.aaf.edu.au/shibboleth in role {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor with protocol urn:oasis:names:tc:SAML:2.0:protocol
2017-06-05 11:56:04,192 - WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:111] - Profile Action SelectProfileConfiguration: Profile http://shibboleth.net/ns/profiles/saml2/sso/browser is not available for RP configuration shibboleth.UnverifiedRelyingParty (RPID https://manager.test.aaf.edu.au/shibboleth)
2017-06-05 11:56:04,196 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: InvalidProfileConfiguration


[3] idp-process.log - metadata not loaded from file backup

2017-06-05 11:55:06,402 - INFO [net.shibboleth.ext.spring.service.ReloadableSpringService:387] - Service 'shibboleth.MetadataResolverService': Reload complete
2017-06-05 11:55:06,412 - INFO [Shibboleth-Audit.Reload:241] - 20170605T015506Z||||http://shibboleth.net/ns/profiles/reload-service-configuration|||||||||
2017-06-05 11:55:11,562 - ERROR [org.opensaml.saml.metadata.resolver.impl.HTTPMetadataResolver:300] - Metadata Resolver FileBackedHTTPMetadataResolver FederationMetadata: Non-ok status code 403 returned from remote metadata source https://md.test.aaf.edu.au/aaf-testt-metadata.xml

2017-06-05 11:55:11,563 - WARN [org.opensaml.saml.metadata.resolver.impl.FileBackedHTTPMetadataResolver:295] - Metadata Resolver FileBackedHTTPMetadataResolver FederationMetadata: Problem reading metadata from remote source; detected existing cached metadata, skipping load of backup file

2017-06-05 11:55:11,590 - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:306] - Metadata Resolver FileBackedHTTPMetadataResolver FederationMetadata: Next refresh cycle for metadata provider 'https://md.test.aaf.edu.au/aaf-testt-metadata.xml' will occur on '2017-06-05T02:10:11.565Z' ('2017-06-05T12:10:11.565+10:00' local time)

|   ALBURY-WODONGA   |   BATHURST   |   CANBERRA   |   DUBBO   |   GOULBURN   |   MELBOURNE   |   ORANGE   |   PORT MACQUARIE   |   SYDNEY   |   WAGGA WAGGA   |

LEGAL NOTICE
This email (and any attachment) is confidential and is intended for the use of the addressee(s) only. If you are not the intended recipient of this email, you must not copy, distribute, take any action in reliance on it or disclose it to anyone. Any confidentiality is not waived or lost by reason of mistaken delivery. Email should be checked for viruses and defects before opening. Charles Sturt University (CSU) does not accept liability for viruses or any consequence which arise as a result of this email transmission. Email communications with CSU may be subject to automated email filtering, which could result in the delay or deletion of a legitimate email before it is read at CSU. The views expressed in this email are not necessarily those of CSU.
Charles Sturt University in Australia The Grange Chancellery, Panorama Avenue, Bathurst NSW Australia 2795 (ABN: 83 878 708 551; CRICOS Provider Number: 00005F (National)). TEQSA Provider Number: PV12018
Consider the environment before printing this email.