LocalDynamic + MetadataFilters = possible bug?

[Cantor, Scott]

On 10/15/20, 11:05 AM, "users on behalf of Mak, Steve" <users-bounces at shibboleth.net on behalf of makst at upenn.edu> wrote:

>    md resolution starts > md filters applied > md resolution ends > md resolution cached > ...skip auth/c14n > (sp scoped) > attribute resolution > attribute resolution cached > (sp scoped) attribute filtering > build SAML assertion/response

I guess roughly. But attribute resolution has very complicated failure modes and many of the options to limit the affects of errors don't even work right, leaving static failovers about the only way to prevent even minor errors from suppressing everything.

It's extremely common for a configuration to react to even a single transitory issue by producing nothing for a request, and the connector "stay dead" period can keep on breaking things for subsequent requests until it goes back online.

If the status page really claims that nothing has ever failed, then that probably can be trusted, but there's no explanation for any of this outside that step. There's just no way the metadata could be the problem unless there's a duplicate.

-- Scott