LocalDynamic + MetadataFilters = possible bug?
makst at upenn.edu
Fri Jan 15 13:36:40 UTC 2021
> This case seems weirder because I think Steve is saying it only happens some of the time. But not sure if that's confirmed.
I can confirm that it only happens some of the time. We haven't been able to isolate any signs to predict when it will happen through our environment monitoring.
> The example seems obfuscated with an "always true" predicate and dummy entity attribute value.
The always-true condition is the real condition we use for production. We globally apply the label to all md files in the subdirectory at load time for filter policies. The dummy attribute values are simply a Penn scoped urn with something very unexciting like "default", "internalapp", or "newvendor". We run about 8 or 9 subdirectories like this, all with the same logic but different attributeValue.
I put in dummy attribute values because they are not important to the problem as far as we can tell.
> maybe the condition is failing in some intermittent way
We had suspected maybe this was the cause as we were originally using a global bean that resolved to always-true. We removed that global bean with the newer shibboleth.Conditions.TRUE to take that global bean out of the picture.
> It seems like there must be a race condition somewhere.
This was the only thing that made logical sense to us as well, we just couldn't prove it with logs because it only happens in production and there are far too many logs if we turn on debug. I might be able to enable debug for just the metadata provider class that is doing the loading, but that seemed unnecessary at this time.
More information about the users