SP : ignored expired metadata instance / Unable to locate metadata for provider

Thu Sep 24 09:59:12 UTC 2020

Hi, 

Every 10-20 days, I am getting this error when a user try to use my SP : " unable to locate metadata for provider" and "unable to locate metadata for provider" 
The user get "Internal Server Error" message error on browser. 

To solve the problem I have to restart shibd daemon, but 10-20 days after, I get the error again. 

All IdP from this error message below are in the metadata : /var/cache/shibboleth/main-all-renater-metadata.xml 
This file have permission (466 shibd:shibd) and refreshing regularly (~4h). 

Below my shib_warn log, httpd log and shibboleth2.xml from my SP. 
Do you see something wrong ? 

Thanks for your help 

Nicolas KRASINSKI 

My SP : CentOS 7.8 server / Shibboleth-3.1.0 

***shibd.log : 
2020-09-24 08:01:23 INFO OpenSAML.MetadataProvider.XML : reloading remote resource... 
2020-09-24 08:01:23 DEBUG OpenSAML.MetadataProvider.XML : remote metadata resource will be backed up to (/var/cache/shibboleth/main-all-renater-metadata.xml.f776) 
2020-09-24 08:01:23 DEBUG OpenSAML.MetadataProvider.XML : loading configuration from external resource... 
2020-09-24 08:01:23 DEBUG OpenSAML.MetadataProvider.XML : writing to backing file: /var/cache/shibboleth/main-all-renater-metadata.xml.f776 
2020-09-24 08:01:23 DEBUG XMLTooling.util.CloneInputStream : initialized 
2020-09-24 08:01:23 DEBUG XMLTooling.util.CloneInputStream : deleted 
2020-09-24 08:01:23 INFO OpenSAML.MetadataProvider.XML : loaded XML resource (https://metadata.federation.renater.fr/renater/main/main-all-renater-metadata.xml) 
2020-09-24 08:01:23 DEBUG XMLTooling.Signature : unmarshalling ds:Signature 
2020-09-24 08:01:24 INFO OpenSAML.MetadataProvider : applying metadata filter (RequireValidUntil) 
2020-09-24 08:01:24 INFO OpenSAML.MetadataProvider : applying metadata filter (Signature) 
2020-09-24 08:01:27 DEBUG OpenSAML.MetadataProvider.XML : committing backup file to permanent location (/var/cache/shibboleth/main-all-renater-metadata.xml) 
2020-09-24 08:01:27 INFO OpenSAML.MetadataProvider.XML : adjusted reload interval to 2700 seconds 
2020-09-24 08:29:57 DEBUG Shibboleth.Listener [416]: dispatching message (set::RelayState) 
2020-09-24 08:29:57 DEBUG XMLTooling.StorageService [416]: inserted record (d26490dad5ff804628727473a374fd25496f2dc0052bcf5b9110b06ec0f837e5) in context (RelayState) with expiration (1600929597) 
2020-09-24 08:30:55 DEBUG Shibboleth.Listener [423]: dispatching message (get::RelayState) 
2020-09-24 08:30:55 DEBUG Shibboleth.Listener [423] [myspID]: dispatching message (myspID/Login::run::SAML2SI) 
2020-09-24 08:30:55 WARN OpenSAML.MetadataProvider [423] [myspID]: ignored expired metadata instance for (https://federation.utbm.fr/idp/shibboleth) 
2020-09-24 08:30:55 WARN Shibboleth.SessionInitiator.SAML2 [423] [myspID]: unable to locate metadata for provider (https://federation.utbm.fr/idp/shibboleth) 
2020-09-24 08:31:10 DEBUG Shibboleth.Listener [420]: dispatching message (get::RelayState) 
2020-09-24 08:31:10 DEBUG Shibboleth.Listener [420] [myspID]: dispatching message (myspID/Login::run::SAML2SI) 
2020-09-24 08:31:10 WARN OpenSAML.MetadataProvider [420] [myspID]: ignored expired metadata instance for (https://federation.utbm.fr/idp/shibboleth) 
2020-09-24 08:31:10 WARN Shibboleth.SessionInitiator.SAML2 [420] [myspID]: unable to locate metadata for provider (https://federation.utbm.fr/idp/shibboleth) 
2020-09-24 08:31:42 DEBUG Shibboleth.Listener [424]: dispatching message (myspID::getHeaders::Application) 
2020-09-24 08:31:42 DEBUG Shibboleth.Listener [424]: dispatching message (set::RelayState) 
2020-09-24 08:31:42 DEBUG XMLTooling.StorageService [424]: inserted record (350e6f600a3797f34513776d8d1f8f61f273b724516302e6f6418bf8dfe0436c) in context (RelayState) with expiration (1600929702) 
2020-09-24 08:31:42 DEBUG Shibboleth.Listener [424]: dispatching message (get::RelayState) 
2020-09-24 08:31:42 DEBUG Shibboleth.Listener [424] [myspID]: dispatching message (myspID/Login::run::SAML2SI) 
2020-09-24 08:31:42 WARN OpenSAML.MetadataProvider [424] [myspID]: ignored expired metadata instance for (https://federation.utbm.fr/idp/shibboleth) 
2020-09-24 08:31:42 WARN Shibboleth.SessionInitiator.SAML2 [424] [myspID]: unable to locate metadata for provider (https://federation.utbm.fr/idp/shibboleth) 
2020-09-24 08:31:55 DEBUG Shibboleth.Listener [425]: dispatching message (myspID::getHeaders::Application) 
2020-09-24 08:31:55 DEBUG Shibboleth.Listener [425]: dispatching message (set::RelayState) 
2020-09-24 08:31:55 DEBUG XMLTooling.StorageService [425]: inserted record (58c4e67d8c64282c6c31ae07a81f3f2c67104f2d984248ef3ecba0743c52c4f8) in context (RelayState) with expiration (1600929715) 
2020-09-24 08:31:55 DEBUG Shibboleth.Listener [425]: dispatching message (get::RelayState) 
2020-09-24 08:31:55 DEBUG Shibboleth.Listener [425] [myspID]: dispatching message (myspID/Login::run::SAML2SI) 
2020-09-24 08:31:55 WARN OpenSAML.MetadataProvider [425] [myspID]: ignored expired metadata instance for (https://federation.utbm.fr/idp/shibboleth) 
2020-09-24 08:31:55 WARN Shibboleth.SessionInitiator.SAML2 [425] [myspID]: unable to locate metadata for provider (https://federation.utbm.fr/idp/shibboleth) 
2020-09-24 08:33:48 DEBUG Shibboleth.Listener [423]: dispatching message (myspID::getHeaders::Application) 
2020-09-24 08:33:48 DEBUG Shibboleth.Listener [423]: dispatching message (set::RelayState) 
2020-09-24 08:33:48 DEBUG XMLTooling.StorageService [423]: inserted record (e24903f21932ef9dd45b1726ea0ae877595cb6502661c370182ffc059d51d926) in context (RelayState) with expiration (1600929828) 
2020-09-24 09:11:26 DEBUG Shibboleth.Listener [423]: dispatching message (set::RelayState) 
2020-09-24 09:11:26 DEBUG XMLTooling.StorageService [423]: inserted record (accc18f481977fc338bfb9d962d21c338ca251631618cd854bf7560b6f93c42d) in context (RelayState) with expiration (1600932086) 
2020-09-24 09:11:35 DEBUG Shibboleth.Listener [416]: dispatching message (get::RelayState) 
2020-09-24 09:11:35 DEBUG Shibboleth.Listener [416] [myspID]: dispatching message (myspID/Login::run::SAML2SI) 
2020-09-24 09:11:35 WARN OpenSAML.MetadataProvider [416] [myspID]: ignored expired metadata instance for (https://antimoine.insa-strasbourg.fr/idp/shibboleth) 
2020-09-24 09:11:35 WARN Shibboleth.SessionInitiator.SAML2 [416] [myspID]: unable to locate metadata for provider (https://antimoine.insa-strasbourg.fr/idp/shibboleth) 
2020-09-24 09:24:51 INFO XMLTooling.StorageService : purged 1 expired record(s) from storage 
2020-09-24 09:26:39 DEBUG Shibboleth.Listener [419]: dispatching message (set::RelayState) 
2020-09-24 09:26:39 DEBUG XMLTooling.StorageService [419]: inserted record (71bf08e27e65119c2cadf3e3d955b480dca897c8dd432ae89fa89234a3c16b0e) in context (RelayState) with expiration (1600932999) 
2020-09-24 09:26:49 DEBUG Shibboleth.Listener [423]: dispatching message (get::RelayState) 
2020-09-24 09:26:49 DEBUG Shibboleth.Listener [423] [myspID]: dispatching message (myspID/Login::run::SAML2SI) 
2020-09-24 09:26:49 WARN OpenSAML.MetadataProvider [423] [myspID]: ignored expired metadata instance for (urn:mace:cru.fr:federation:univ-littoral.fr) 
2020-09-24 09:26:49 WARN Shibboleth.SessionInitiator.SAML2 [423] [myspID]: unable to locate metadata for provider (urn:mace:cru.fr:federation:univ-littoral.fr) 

***httpd error log 
[Thu Sep 24 08:30:55.119259 2020] [mod_shib:error] [pid 32074] [client xxx.xxx.xxx.xxx:47646] Unable to locate metadata for identity provider (https://federation.utbm.fr/idp/shibboleth), referer: https://discovery.renater.fr/renater/?entityID=https%3A%2F%2Fmysp.fr&return=https%3A%2F%2Fmysp.fr%2Fapi%2FShibboleth.sso%2FLogin%3FSAMLDS%3D1%26target%3Dss%253Amem%253Ad26490dad5ff804628727473a374fd25496f2dc0052bcf5b9110b06ec0f837e5 
[Thu Sep 24 08:31:10.431285 2020] [mod_shib:error] [pid 32165] [client xxx.xxx.xxx.xxx:48768] Unable to locate metadata for identity provider (https://federation.utbm.fr/idp/shibboleth), referer: https://discovery.renater.fr/renater/?entityID=https%3A%2F%2Fmysp.fr&return=https%3A%2F%2Fmysp.fr%2Fapi%2FShibboleth.sso%2FLogin%3FSAMLDS%3D1%26target%3Dss%253Amem%253Ad26490dad5ff804628727473a374fd25496f2dc0052bcf5b9110b06ec0f837e5 
[Thu Sep 24 08:31:42.871628 2020] [mod_shib:error] [pid 32075] [client xxx.xxx.xxx.xxx:50226] Unable to locate metadata for identity provider (https://federation.utbm.fr/idp/shibboleth), referer: https://mysp.fr/ 
[Thu Sep 24 08:31:55.658043 2020] [mod_shib:error] [pid 1709] [client xxx.xxx.xxx.xxx:50770] Unable to locate metadata for identity provider (https://federation.utbm.fr/idp/shibboleth), referer: https://mysp.fr/ 
[Thu Sep 24 08:34:02.152674 2020] [mod_shib:error] [pid 32165] [client xxx.xxx.xxx.xxx:58788] Unable to locate metadata for identity provider (urn:mace:cru.fr:federation:univ-littoral.fr), referer: https://discovery.renater.fr/ 
[Thu Sep 24 08:34:11.320176 2020] [mod_shib:error] [pid 32000] [client xxx.xxx.xxx.xxx:58792] Unable to locate metadata for identity provider (urn:mace:cru.fr:federation:univ-littoral.fr), referer: https://discovery.renater.fr/ 
[Thu Sep 24 08:37:08.335304 2020] [mod_shib:error] [pid 1709] [client xxx.xxx.xxx.xxx:49828] Unable to locate metadata for identity provider (https://federation.utbm.fr/idp/shibboleth), referer: https://mysp.fr/ 
[Thu Sep 24 08:37:31.289204 2020] [mod_shib:error] [pid 30979] [client xxx.xxx.xxx.xxx:51056] Unable to locate metadata for identity provider (https://federation.utbm.fr/idp/shibboleth), referer: https://mysp.fr/ 
[Thu Sep 24 08:38:21.700866 2020] [mod_shib:error] [pid 32074] [client xxx.xxx.xxx.xxx:54664] Unable to locate metadata for identity provider (https://federation.utbm.fr/idp/shibboleth), referer: https://mysp.fr/about 
[Thu Sep 24 08:44:45.696254 2020] [mod_shib:error] [pid 30979] [client xxx.xxx.xxx.xxx:56992] Unable to locate metadata for identity provider (https://federation.utbm.fr/idp/shibboleth), referer: https://mysp.fr/ 
[Thu Sep 24 09:11:35.183399 2020] [mod_shib:error] [pid 30928] [client xxx.xxx.xxx.xxx:61810] Unable to locate metadata for identity provider (https://antimoine.insa-strasbourg.fr/idp/shibboleth), referer: https://discovery.renater.fr/ 
[Thu Sep 24 09:26:49.553839 2020] [mod_shib:error] [pid 32074] [client xxx.xxx.xxx.xxx:59360] Unable to locate metadata for identity provider (urn:mace:cru.fr:federation:univ-littoral.fr), referer: https://discovery.renater.fr/ 
[Thu Sep 24 09:32:27.736047 2020] [mod_shib:error] [pid 30979] [client xxx.xxx.xxx.xxx:51200] Unable to locate metadata for identity provider (urn:mace:cru.fr:federation:unilim.fr), referer: https://discovery.renater.fr/ 
[Thu Sep 24 09:32:30.401291 2020] [mod_shib:error] [pid 32074] [client xxx.xxx.xxx.xxx:51205] Unable to locate metadata for identity provider (urn:mace:cru.fr:federation:unilim.fr), referer: https://discovery.renater.fr/ 
[Thu Sep 24 09:32:35.150975 2020] [mod_shib:error] [pid 30928] [client xxx.xxx.xxx.xxx:51201] Unable to locate metadata for identity provider (urn:mace:cru.fr:federation:unilim.fr), referer: https://discovery.renater.fr/ 
[Thu Sep 24 09:32:44.302707 2020] [mod_shib:error] [pid 32165] [client xxx.xxx.xxx.xxx:51247] Unable to locate metadata for identity provider (urn:mace:cru.fr:federation:unilim.fr), referer: https://discovery.renater.fr/ 
[Thu Sep 24 09:37:30.816704 2020] [mod_shib:error] [pid 1709] [client xxx.xxx.xxx.xxx:56253] Unable to locate metadata for identity provider (https://shibboleth.csi.uvsq.fr/idp/shibboleth), referer: https://discovery.renater.fr/renater/?entityID=https%3A%2F%2Fmysp.fr&return=https%3A%2F%2Fmysp.fr%2Fapi%2FShibboleth.sso%2FLogin%3FSAMLDS%3D1%26target%3Dss%253Amem%253A0de5a06abb7ca47ca78de302099cd4121d3d904fe39d923d3ad560b6b064fe04 
[Thu Sep 24 09:38:38.393735 2020] [mod_shib:error] [pid 32075] [client xxx.xxx.xxx.xxx:56263] Unable to locate metadata for identity provider (https://shibboleth.csi.uvsq.fr/idp/shibboleth), referer: https://discovery.renater.fr/renater/WAYF?entityID=https%3A%2F%2Fmysp.fr&return=https%3A%2F%2Fmysp.fr%2Fapi%2FShibboleth.sso%2FLogin%3FSAMLDS%3D1%26target%3Dss%253Amem%253A0de5a06abb7ca47ca78de302099cd4121d3d904fe39d923d3ad560b6b064fe04 
[Thu Sep 24 09:39:02.608279 2020] [mod_shib:error] [pid 28160] [client xxx.xxx.xxx.xxx:44410] Unable to locate metadata for identity provider (https://shibboleth.csi.uvsq.fr/idp/shibboleth), referer: https://mysp.fr/ 
[Thu Sep 24 09:39:32.876410 2020] [mod_shib:error] [pid 30928] [client xxx.xxx.xxx.xxx:45591] Unable to locate metadata for identity provider (https://shibboleth.csi.uvsq.fr/idp/shibboleth), referer: https://mysp.fr/ 
[Thu Sep 24 09:44:09.564846 2020] [mod_shib:error] [pid 28160] [client xxx.xxx.xxx.xxx:56576] Unable to locate metadata for identity provider (https://shibboleth.csi.uvsq.fr/idp/shibboleth), referer: https://mysp.fr/ 

***shibboleth2.xml 

<SPConfig xmlns="urn:mace:shibboleth:3.0:native:sp:config" 
xmlns:conf="urn:mace:shibboleth:3.0:native:sp:config" 
clockSkew="180"> 

<OutOfProcess tranLogFormat="%u|%s|%IDP|%i|%ac|%t|%attr|%n|%b|%E|%S|%SS|%L|%UA|%a" /> 

<ApplicationDefaults entityID="mysp" 
REMOTE_USER="eppn subject-id pairwise-id persistent-id" 
cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1"> 

<Sessions lifetime="28800" timeout="3600" relayState="ss:mem" consistentAddress="true" 
checkAddress="false" handlerSSL="true" cookieProps="https" handlerURL="/api/Shibboleth.sso" > 

<SSO discoveryProtocol="SAMLDS" discoveryURL="https://discovery.renater.fr/renater"> 
SAML2 
</SSO> 

<Logout>SAML2 Local</Logout>

<!-- Administrative logout. --> 
<LogoutInitiator type="Admin" Location="/Logout/Admin" acl="127.0.0.1 ::1" /> 

<Handler type="MetadataGenerator" Location="/Metadata" signing="false"/>

<!-- Status reporting service. --> 
<Handler type="Status" Location="/Status" acl="127.0.0.1 ::1"/> 

<Handler type="Session" Location="/Session" showAttributeValues="false"/>

<Handler type="DiscoveryFeed" Location="/DiscoFeed"/> 
</Sessions>

<Errors supportContact="root at localhost" 
metadata="metadataError_fr.html" 
access="accessError_fr.html" 
ssl="sslError_fr.html" 
localLogout="localLogout_fr.html" 
globalLogout="globalLogout_fr.html" 
helpLocation="/about.html" 
styleSheet="/shibboleth-sp/main.css"/> 

<MetadataProvider type="XML" 
url="https://metadata.federation.renater.fr/renater/main/main-all-renater-metadata.xml" 
backingFilePath="main-all-renater-metadata.xml" reloadInterval="7200"> 
<MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/> 
<MetadataFilter type="Signature" certificate="renater-metadata-signing-cert-2016.pem"/> 
</MetadataProvider> 

<ApplicationOverride id="myspID" entityID="https://www.mysp.fr"> 
<Sessions lifetime="28800" timeout="3600" relayState="ss:mem" checkAddress="false" 
consistentAddress="true" handlerSSL="true" cookieProps="https" handlerURL="/api/Shibboleth.sso"> 
<SSO discoveryProtocol="SAMLDS" discoveryURL="https://discovery.renater.fr/renater"> 
SAML2 
</SSO> 
</Sessions> 
<MetadataProvider type="XML" 
url="https://metadata.federation.renater.fr/renater/main/main-all-renater-metadata.xml" 
backingFilePath="main-all-renater-metadata.xml"> 
<MetadataFilter type="RequireValidUntil" maxValidityInterval="2419200"/> 
<MetadataFilter type="Signature" certificate="renater-metadata-signing-cert-2016.pem"/> 
</MetadataProvider> 
<MetadataProvider type="XML" url="https://cru.renater.fr/idp/shibboleth" backingFilePath="sac-metadata.xml" reloadInterval="7200"/> </ApplicationOverride> 

<AttributeExtractor type="XML" validate="true" reloadChanges="false" path="attribute-map.xml"/> 

<AttributeFilter type="XML" validate="true" path="attribute-policy.xml"/> 

<CredentialResolver type="File" use="signing" 
key="sp-signing-key.pem" certificate="sp-signing-cert.pem"/> 
<CredentialResolver type="File" use="encryption" 
key="sp-encrypt-key.pem" certificate="sp-encrypt-cert.pem"/> 

</ApplicationDefaults> 

<SecurityPolicyProvider type="XML" validate="true" path="security-policy.xml"/> 

<ProtocolProvider type="XML" validate="true" reloadChanges="false" path="protocols.xml"/> 

</SPConfig> 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200924/97818453/attachment.htm>