Error loading metadata file

[Brent Putman]

On 6/4/17 10:11 PM, Lipscomb, Gary wrote:

In particular, what's actually happening related to what Scott already
said, is:

>
> [3] idp-process.log - metadata not loaded from file backup
>
> 2017-06-05 11:55:06,402 - INFO [net.shibboleth.ext.spring.service.ReloadableSpringService:387] - Service 'shibboleth.MetadataResolverService': Reload complete
> 2017-06-05 11:55:06,412 - INFO [Shibboleth-Audit.Reload:241] - 20170605T015506Z||||http://shibboleth.net/ns/profiles/reload-service-configuration|||||||||

The metadata resolver has "successfully" loaded in the startup
foreground thread.  It initialized itself from the backup file only (per
the default of initializeFromBackupFile, see [1]).  Since as you said,
the backup file's signature is broken, this "successfully" resulted in
an empty data set.  This is as expected.  I think you should be seeing
some logging to this effect; for sure you will on DEBUG.


> 2017-06-05 11:55:11,562 - ERROR [org.opensaml.saml.metadata.resolver.impl.HTTPMetadataResolver:300] - Metadata Resolver FileBackedHTTPMetadataResolver FederationMetadata: Non-ok status code 403 returned from remote metadata source https://md.test.aaf.edu.au/aaf-testt-metadata.xml
>
> 2017-06-05 11:55:11,563 - WARN [org.opensaml.saml.metadata.resolver.impl.FileBackedHTTPMetadataResolver:295] - Metadata Resolver FileBackedHTTPMetadataResolver FederationMetadata: Problem reading metadata from remote source; detected existing cached metadata, skipping load of backup file

5 seconds later (per the default of backupFileInitNextRefreshDelay, see
[1]), it's then executing in a background thread a refresh via fetch
from the remote source URL.  Since that URL is invalid, that fails,
again as expected.

So in the end you are left with a resolver with no metadata.  This is as
expected, given what you have said.

In short, you can't break *both* the backup file on disk *and* the URL,
and expect it work after a restart/reload.  One or the other can fail,
but not both.


[1]
https://wiki.shibboleth.net/confluence/display/IDP30/HTTPMetadataProviders

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170605/d2289f24/attachment.html>