unexpected MDQ calls & warnings

[Andrew Jason Morgan]

David,

I see this happen here too.  I haven't figured it out yet, so I'm just adding my "me too!"

Thanks,
Andy

________________________________
From: users <users-bounces at shibboleth.net> on behalf of IAM David Bantz <dabantz at alaska.edu>
Sent: Monday, February 8, 2021 1:17 PM
To: Users at shibboleth.net <Users at shibboleth.net>
Subject: unexpected MDQ calls & warnings


[This email originated from outside of OSU. Use caution with links and attachments.]

I get a warning like the following when my IdP v4.0.1 services CAS requests:


00:15:09:542  WARN [72.35.110.140] org.opensaml.saml.metadata.resolver.impl.AbstractDynamicHTTPMetadataResolver:354 >  Metadata Resolver FunctionDrivenDynamicHTTPMetadataResolver URLMDQ_incommon: Non-ok status code '404' returned from remote metadata source: https://mdq.incommon.org/entities/uid-services


cas-protocol.xml configuration should, AFAIK, avoid triggering MDQ or InCommon use:


    <util:list id="shibboleth.CASServiceRegistries">

        <ref bean="shibboleth.CASServiceRegistry" />

    </util:list>

The only places where the group name is used are in the CAS registry in cas-protocol.xml:


      <bean class="net.shibboleth.idp.cas.service.ServiceDefinition"

              c:regex="^https?://epay\.alaska\.edu(:\d+)?(/.*)?$"

              p:group="uid-services"

              p:authorizedToProxy="false" />


in relying-party.xml


       <!-- CAS services needing UID as CAS username  -->

       <bean parent="RelyingPartyByGroup" c:groupNames="uid-services">

            <property name="profileConfigurations">

                <list>

                    <bean parent="CAS.LoginConfiguration" />

                    <bean parent="CAS.ValidateConfiguration" p:userAttribute="uid"/>

               </list>

           </property>

       </bean>


and in attribute-filter.xml


  <AttributeFilterPolicy id="releaseToCASuidServcies">

     <PolicyRequirementRule xsi:type="InEntityGroup" groupID="uid-services"/>

     <AttributeRule attributeID="uid" permitAny="true"/>

  </AttributeFilterPolicy>


Seems one of those is triggering am MDQ query to the InCommon metadata for

mysterious (to me) reason.


How do I prevent those needless remote queries?


David St. Pierre Bantz

U Alaska IAM
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210208/d2a851c5/attachment.htm>