shibboleth.MetadataResolverService

[Tom Scavo]

On Fri, Jun 29, 2018 at 11:22 PM, Hugo Slavia <hugoslavia101 at gmail.com> wrote:
>
> NB: The metadata URL is reachable from IdP server (if I delete the file in
> idp server and restart --- it is downloaded)

You can use curl to probe a metadata source:

$ curl --silent --head https://example.edu/idp/sp-metadata.xml

In particular, the response headers will tell you if the server
supports HTTP conditional GET.

> 1) what can I troubleshoot to check why not downloading remote metadata file
> when prompted via --
> https://server-name/idp/profile/admin/reload-service?id=shibboleth.MetadataResolverService.
> The remote file has been changed and the logs are showing ' Metadata
> Resolver FileBackedHTTPMetadataResolver HTTPMetadata: New metadata
> successfully loaded for 'https://example.edu/idp/sp-metadata.xml''

What are you trying to troubleshoot? Is there a warning or error
message in the logs?

> 2) 'HTTPMetadata' reloads every 4 hours --- where is this set to change
> frequency (the remote file does not have a 'validUntil' )?

That is documented on the FileBackedHTTPMetadataProvider [1] wiki page
(which was recently overhauled). In particular, look at the
maxRefreshDelay attribute.

> <MetadataProvider id="HTTPMetadata"
>                       xsi:type="FileBackedHTTPMetadataProvider"
>                       xmlns="urn:mace:shibboleth:2.0:metadata"
>                       metadataURL="https://example.edu/idp/sp-metadata.xml"
>
> backingFile="/opt/shibboleth-idp/conf/sp-metadata.xml">
>
>     </MetadataProvider>

Does your FileBackedHTTPMetadataProvider really have no child elements
or did you remove those for posting?

The fact that want to reload metadata that is already configured with
a reloading metadata provider suggests you may be doing it wrong.
Without knowing more, I can't say for sure, but I'll guess that a
LocalDynamicMetadataProvider may be more appropriate in this case. See
the MetadataManagementBestPractices [2] topic (which is new) for
options and recommendations.

Hope this helps,

Tom

[1] FileBackedHTTPMetadataProvider
https://wiki.shibboleth.net/confluence/x/kQInAQ
[2] MetadataManagementBestPractices
https://wiki.shibboleth.net/confluence/x/JQXKAg