shibboleth-embedded-ds, shibd, and json cache file name

[Paul Fardy]

I'm using embedded DS and I'm having trouble with the JSON cache file.

My concern: /Shibboleth.sso/DiscoFeed may fail unpredictably.

My host is "login10". My web/SP/IdP server name is either IdPx.utorauth or IdPz.utorauth.
Running shibboleth-3.0.4 shibd.

> login10 # yum list shibboleth
> Loaded plugins: fastestmirror
> Loading mirror speeds from cached hostfile
>  * base: mirror.layeronline.com
>  * epel: d2lzkl7pfhq30w.cloudfront.net
>  * extras: mirror.layeronline.com
>  * updates: mirror.layeronline.com
> Installed Packages
> shibboleth.x86_64    3.0.4-3.2   @shibboleth

And from my desktop:
> $ curl -k https://login10.ns.utoronto.ca/Shibboleth.sso/DiscoFeed
> Discovery Request Failed

My understanding is that mod_shib (.../Shibboleth.sso/DiscoFeed) doesn't know the file name and doesn't need to know the name. mod_shib asks shibd and shibd maintains the cache.

I have had a working dev site:

   SP entityID="https://sp.idpx.utorauth.utoronto.ca/shibboleth"
   IdP entityID="https://idpx.utorauth.utoronto.ca/shibboleth"
   hostname="idpx.utorauth.utoronto.ca"

Background: I'm putting an SP on my IdP host and chose two entityIDs, rather than modifying the prod IdP EntityDescriptors.
   I know I can use two roles within one EntityDescriptor.
   I see no problems with two EntityDescriptor, but maybe this *is* a source of trouble.
   .. and IdPx is my dev site. ]]

I'm trying to re-config my test host as IdPz.utorauth. I'm testing what worked with IdPx and debugging why it doesn't work on IdPz.

   SP entityID=https://sp.idpz.utorauth.utoronto.ca/shibboleth
   IdP entityID="https://idpz.utorauth.utoronto.ca/shibboleth"
   SP hostname="idpz.utorauth.utoronto.ca"

I found an error "cannot access [long file name]". The file did not exist... because somethings not using the correct cache file name.
Perhaps the entityID or server hostname is encoded in the filename as I see

   ...96470782e757... vs
   ...964707a2e757...

but there's also an 8 hex digit sequence that also varies. 

> # cd /var/cache/shibboleth/OLD
> # sum 646*.json
> 42013     3 64656661756c7468747470733a2f2f73702e696470782e75746f72617574682e75746f726f6e746f2e63612f73686962626f6c657468_99ce83e3.json
> 42013     3 64656661756c7468747470733a2f2f73702e696470782e75746f72617574682e75746f726f6e746f2e63612f73686962626f6c657468_fc251e17.json
> 42013     3 64656661756c7468747470733a2f2f73702e6964707a2e75746f72617574682e75746f726f6e746f2e63612f73686962626f6c657468_1a26f6a5.json
> 42013     3 64656661756c7468747470733a2f2f73702e6964707a2e75746f72617574682e75746f726f6e746f2e63612f73686962626f6c657468_3fbc04bc.json
> 42013     3 64656661756c7468747470733a2f2f73702e6964707a2e75746f72617574682e75746f726f6e746f2e63612f73686962626f6c657468_fc251e17.json

And currently,
> -rw-r--r-- 1 shibd shibd 2460 Aug 12 16:43 64656661756c7468747470733a2f2f73702e6964707a2e75746f72617574682e75746f726f6e746f2e63612f73686962626f6c657468_bbb032cf.json
> -rw-r--r-- 1 shibd shibd 2460 Aug 12 22:48 64656661756c7468747470733a2f2f73702e696470782e75746f72617574682e75746f726f6e746f2e63612f73686962626f6c657468_3b392ec9.json

The 16:43 file was as IdPx, the other as IdPz.

Why are the filenames changing and, if it's just a cache, why doesn't the process recreate it rather fail and log "cannot access ..."?
(Also, the OS error, presumably "no such file", is not in the error log.

I see more files and I think the cache changes when the source metadata file changes. But all of the above cache files have the same content.

My fear is a metadata file update will unpredictably break my /DiscoFeed service.

I stop httpd and shibd (and tomcat, but that's not in the use case yet). I start shibd before httpd. Does that matter? I start tomcat last, but the IdP isn't yet in the use case.

Paul
-- 
Paul Fardy, Shib Admin, Info Security, ITS
University of Toronto