Windows SP 2.6.0

[Young, Darren]

We have been running the Windows SP version 2.5.1, primarily on Server
2008 R2, for the last 2 years or so, I am now testing out the 2.6.0
version (on Server 2012 R2). We¹ve been having startup issues and I¹ve
narrowed it down to the InCommon metadata portion of the Shibboleth2.xml
file. The config we have been running is:

<!-- InCommon metadata -->
<MetadataProvider type=³XML"
                  
uri="http://md.incommon.org/InCommon/InCommon-metadata.xml"
                  backingFilePath="InCommon-metadata.xml"
reloadInterval="14400">
   <MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/>
   <MetadataFilter type="Signature" certificate="inc-md-cert.pem"/>
</MetadataProvider>

When I start the service from services.msc it says something like ³failed
to start² so I went to a command line, that gets the following:

C:\>net start shibd_default
The Shibboleth 2 Daemon (Default) service is starting....
The Shibboleth 2 Daemon (Default) service could not be started.

More help is available by typing NET HELPMSG 3523.

Net helpmsg on that is ³The service could not be started².

At that point in time the logs show this:

2017-06-07 15:56:39 INFO Shibboleth.Application : building
MetadataProvider of type XML...
2017-06-07 15:56:39 INFO OpenSAML.Metadata : building MetadataFilter of
type RequireValidUntil
2017-06-07 15:56:39 INFO OpenSAML.Metadata : building MetadataFilter of
type Signature
2017-06-07 15:56:39 INFO XMLTooling.SecurityHelper : loading
certificate(s) from file
(C:/opt/shibboleth-sp/etc/shibboleth/inc-md-cert.pem)
2017-06-07 15:56:39 INFO XMLTooling.CredentialResolver.File : no private
key resolved, usable for verification/trust only
2017-06-07 15:56:40 INFO OpenSAML.MetadataProvider.XML : remote resource
(http://md.incommon.org/InCommon/InCommon-metadata.xml) unchanged,
adjusted reload interval to 14400 seconds
2017-06-07 15:56:40 INFO OpenSAML.MetadataProvider.XML : using local
backup of remote resource
2017-06-07 15:56:41 INFO OpenSAML.MetadataProvider.XML : loaded XML
resource (C:/opt/shibboleth-sp/var/cache/shibboleth/InCommon-metadata.xml)
2017-06-07 15:56:47 INFO OpenSAML.Metadata : applying metadata filter
(RequireValidUntil)
2017-06-07 15:56:47 INFO OpenSAML.Metadata : applying metadata filter
(Signature)

It sits here for almost exactly 5 minutes then I see this:

2017-06-07 16:04:35 INFO Shibboleth.Application : no TrustEngine specified
or installed, using default chain {ExplicitKey, PKIX}
2017-06-07 16:04:35 INFO OpenSAML.MetadataProvider.XML : reload thread
started...running every 14400 seconds

At that point the service appears to be up and running correctly. I can
get /Shibboleth.sso/Status, /Shibboleth.sso/Metadata, registered it and
logged in to a test page behind /secure/ (which is protected).

Seems the portion "no TrustEngine specified or installed, using default
chain {ExplicitKey, PKIX}² should mean something but I¹ve been unable to
locate anything that works. No luck with Google.

I then discovered there is now an IdP only aggregate so I reconfigured the
SP to use that with the following config:

<MetadataProvider type="XML"
     url="http://md.incommon.org/InCommon/InCommon-metadata-idp-only.xml"
     backingFilePath="InCommon-metadata-idp-only.xml"
     maxRefreshDelay="3600">
           <MetadataFilter type="RequireValidUntil"
maxValidityInterval="2419200"/>
           <MetadataFilter type="Signature" certificate="inc-md-cert.pem"/>
        </MetadataProvider>


Same thing, a near exact 5 minute timeout noted in the log file. Then the
SP comes up and appears to work fine.

Any ideas what¹s causing this?

Is there something different I should be specifying in the 2.6.0 SP config
for InCommon XML loaded metadata?

Thanks in advance,

Darren Young
University of Chicago
Booth School of Business