unexpected MDQ calls & warnings

[IAM David Bantz]

I get a warning like the following when my IdP v4.0.1 services CAS requests:

00:15:09:542  WARN [72.35.110.140]
org.opensaml.saml.metadata.resolver.impl.AbstractDynamicHTTPMetadataResolver:354
>  Metadata Resolver FunctionDrivenDynamicHTTPMetadataResolver URLMDQ_incommon:
Non-ok status code '404' returned from remote metadata source:
https://mdq.incommon.org/entities/uid-services


cas-protocol.xml configuration should, AFAIK, avoid triggering MDQ or
InCommon use:

    <util:list id="shibboleth.CASServiceRegistries">

        <ref bean="shibboleth.CASServiceRegistry" />

    </util:list>

The only places where the group name is used are in the CAS registry in
cas-protocol.xml:

      <bean class="net.shibboleth.idp.cas.service.ServiceDefinition"

              c:regex="^https?://epay\.alaska\.edu(:\d+)?(/.*)?$"

              p:group="uid-services"

              p:authorizedToProxy="false" />


in relying-party.xml


       <!-- CAS services needing UID as CAS username  -->

       <bean parent="RelyingPartyByGroup" c:groupNames="uid-services">

            <property name="profileConfigurations">

                <list>

                    <bean parent="CAS.LoginConfiguration" />

                    <bean parent="CAS.ValidateConfiguration" p:userAttribute
="uid"/>

               </list>

           </property>

       </bean>


and in attribute-filter.xml


  <AttributeFilterPolicy id="releaseToCASuidServcies">

     <PolicyRequirementRule xsi:type="InEntityGroup" groupID="uid-services"
/>

     <AttributeRule attributeID="uid" permitAny="true"/>

  </AttributeFilterPolicy>


Seems one of those is triggering am MDQ query to the InCommon metadata for

mysterious (to me) reason.


How do I prevent those needless remote queries?


David St. Pierre Bantz

U Alaska IAM
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210208/c88230c8/attachment.htm>