LocalMetadata SAMLtest transition issue

[Nate Klingenstein]

Some testers using SAMLtest.id may have had issues with the IdP not recognizing their SP even after an upload of valid metadata.  From what I can tell, this issue occurred when I added SAMLtest's own SP to the IdP's metadata-providers.xml as a FilesystemMetadataResolver before the LocalDynamicMetadataProvider even though both MetadataProviders were wrapped in a Chaining metadata provider.

metadata-providers.xml:
<MetadataProvider id="ShibbolethMetadata" xsi:type="ChainingMetadataProvider"

...

    <MetadataProvider id="SAMLtest" xsi:type="FilesystemMetadataProvider" metadataFile="/var/www/html/saml/sp" minRefreshDelay="PT10S" maxRefreshDelay="PT10S"/>
    <MetadataProvider id="SAMLtestFolder" xsi:type="LocalDynamicMetadataProvider" sourceDirectory="/home/mdupload"/>
</MetadataProvider>


Log A: (SAMLtest SP metadata provider  enabled)

2019-03-19 06:35:12,432 - DEBUG [PROTOCOL_MESSAGE:?] -
<?xml version="1.0" encoding="UTF-8"?>
<saml2p:AuthnRequest
    AssertionConsumerServiceURL="https://redacted.com/spr-aelp-api/auth/saml/consumer"
    ID="zeafd7697-20f8-47dd-9c7c-6f0ea9b276c5"
    IssueInstant="2019-03-19T06:35:10.661Z"
    ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
    Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://redacted.com/saml</saml2:Issuer>
    <saml2p:NameIDPolicy Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"/>
</saml2p:AuthnRequest>

2019-03-19 06:35:12,438 - DEBUG [org.opensaml.saml.metadata.resolver.impl.AbstractBatchMetadataResolver:?] - Metadata Resolver FilesystemMetadataResolver SAMLtest: Resolved 0 candidates via EntityIdCriterion: EntityIdCriterion [id=https://redacted.com/saml]
2019-03-19 06:35:12,438 - DEBUG [org.opensaml.saml.metadata.resolver.impl.PredicateRoleDescriptorResolver:?] - Resolved no EntityDescriptors via underlying MetadataResolver, returning empty collection
2019-03-19 06:35:12,438 - INFO [org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler:?] - Message Handler:  No metadata returned for https://redacted.com/saml in role {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor with protocol urn:oasis:names:tc:SAML:2.0:protocol
2019-03-19 06:35:12,439 - DEBUG [org.opensaml.saml.common.binding.impl.SAMLAddAttributeConsumingServiceHandler:?] - Message Handler:  No metadata context found, nothing to do
2019-03-19 06:35:12,439 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeRelyingPartyContextFromSAMLPeer:?] - Profile Action InitializeRelyingPartyContextFromSAMLPeer: Attaching RelyingPartyContext based on SAML peer https://redacted.com/saml
2019-03-19 06:35:12,439 - WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:?] - Profile Action SelectProfileConfiguration: Profile http://shibboleth.net/ns/profiles/saml2/sso/browser is not available for RP configuration shibboleth.UnverifiedRelyingParty (RPID https://redacted.com/saml)

Once I commented out the FilesystemMetadataProvider, everything worked.

Log B: (SAMLtest SP metadata provider disabled)

2019-03-19 07:18:44,158 - DEBUG [PROTOCOL_MESSAGE:?] - 
SAML 2 IdP-initiated request was: IdPInitiatedSSORequest{entityId=https://redacted.com/saml, acsURL=null, relayState=null, time=2019-03-19T07:18:44.147Z}
Synthetically constructed SAML 2 AuthnRequest was: 
<?xml version="1.0" encoding="UTF-8"?>
<saml2p:AuthnRequest ID="_5243621e-1d52-43ae-ba21-475232780f15"
    IssueInstant="2019-03-19T07:18:44.147Z" Version="2.0" xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol">
    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://redacted.com/saml</saml2:Issuer>
    <saml2p:NameIDPolicy AllowCreate="true"/>
</saml2p:AuthnRequest>

2019-03-19 07:18:44,158 - DEBUG [net.shibboleth.idp.saml.profile.impl.BaseIdPInitiatedSSORequestMessageDecoder:?] - Successfully decoded message from HttpServletRequest.
2019-03-19 07:18:44,289 - INFO [org.opensaml.saml.metadata.resolver.impl.AbstractDynamicMetadataResolver:?] - Metadata Resolver LocalDynamicMetadataResolver SAMLtestFolder: Successfully loaded new EntityDescriptor with entityID 'https://redacted.com/saml' from origin source
2019-03-19 07:18:44,290 - DEBUG [org.opensaml.saml.metadata.resolver.impl.PredicateRoleDescriptorResolver:?] - Resolved 1 source EntityDescriptors
2019-03-19 07:18:44,292 - DEBUG [org.opensaml.saml.metadata.resolver.impl.PredicateRoleDescriptorResolver:?] - Resolved 1 RoleDescriptor candidates via role criteria, performing predicate filtering
2019-03-19 07:18:44,292 - DEBUG [org.opensaml.saml.metadata.resolver.impl.PredicateRoleDescriptorResolver:?] - Attempting to filter candidate RoleDescriptors via resolved Predicates
2019-03-19 07:18:44,293 - DEBUG [org.opensaml.saml.metadata.resolver.impl.PredicateRoleDescriptorResolver:?] - After predicate filtering 1 RoleDescriptors remain

I'm sorry if I made any stupid mistakes here and you were impacted by this and convinced you had done something wrong.  I combed the documentation but I'm not entirely sure why it would behave this way.  Either way, things should be back on track now.

My apologies,
Nate.