Metadata resolver failing to initialise due to one failed metadata provider

[Max Spicer]

Our test IdP recently failed after a restart because one of
our FileBackedHTTPMetadataProviders couldn't validate the certificate from
the remote resource and had no existing backing file. The certificate was
indeed invalid for that provider, but I'm surprised that this apparently
caused the whole metadata resolver to fail to initialise.

On startup, this was logged:

ERROR [org.opensaml.saml.metadata.resolver.impl.HTTPMetadataResolver:238] [
] - Metadata Resolver FileBackedHTTPMetadataResolver foobar: Error
retrieving metadata from https://example.com/metadata: PKIX path building
failed: sun.security.provider.certpath.SunCertPathBuilderException: unable
to find valid certification path to requested target
ERROR
[org.opensaml.saml.metadata.resolver.impl.FileBackedHTTPMetadataResolver:317]
[ ] - Metadata Resolver FileBackedHTTPMetadataResolver foobar: Unable to
read metadata from remote server and backup does not exist
ERROR
[org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:377]
[ ] - Metadata Resolver FileBackedHTTPMetadataResolver foobar: Error
occurred while attempting to refresh metadata from '
https://example.com/metadata'
ERROR
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:292] [ ]
- Metadata Resolver FileBackedHTTPMetadataResolver foobar: Metadata
provider failed to properly initialize, fail-fast=true, halting
ERROR
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:182]
[ ] - Service 'shibboleth.MetadataResolverService': Initial load failed
net.shibboleth.utilities.java.support.service.ServiceException: Failed to
load [file [/opt/shibboleth-idp/conf/metadata-providers.xml], file
[/opt/shibboleth-idp/system/conf/metadata-providers-system.xml]]
        at
net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:387)
Caused by: org.springframework.beans.factory.BeanCreationException: Error
creating bean with name 'ShibbolethMetadata': Cannot create inner bean
'(inner bean)#1a958d2a' of type
[org.opensaml.saml.metadata.resolver.ChainingMetadataResolver] while
setting bean property 'embeddedResolver'; nested exception is
org.springframework.beans.factory.BeanCreationException: Error creating
bean with name '(inner bean)#1a958d2a': Cannot create inner bean '(inner
bean)#39a9b3ee' of type
[org.opensaml.saml.metadata.resolver.impl.FileBackedHTTPMetadataResolver]
while setting bean property 'resolvers' with key [68]; nested exception is
org.springframework.beans.factory.BeanCreationException: Error creating
bean with name '(inner bean)#39a9b3ee': Invocation of init method failed;
nested exception is
net.shibboleth.utilities.java.support.component.ComponentInitializationException:
Error refreshing metadata during init
        at
org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBean(BeanDefinitionValueResolver.java:389)
Caused by: org.springframework.beans.factory.BeanCreationException: Error
creating bean with name '(inner bean)#1a958d2a': Cannot create inner bean
'(inner bean)#39a9b3ee' of type
[org.opensaml.saml.metadata.resolver.impl.FileBackedHTTPMetadataResolver]
while setting bean property 'resolvers' with key [68]; nested exception is
org.springframework.beans.factory.BeanCreationException: Error creating
bean with name '(inner bean)#39a9b3ee': Invocation of init method failed;
nested exception is
net.shibboleth.utilities.java.support.component.ComponentInitializationException:
Error refreshing metadata during init
        at
org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBean(BeanDefinitionValueResolver.java:389)
Caused by: org.springframework.beans.factory.BeanCreationException: Error
creating bean with name '(inner bean)#39a9b3ee': Invocation of init method
failed; nested exception is
net.shibboleth.utilities.java.support.component.ComponentInitializationException:
Error refreshing metadata during init
        at
org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1796)
Caused by:
net.shibboleth.utilities.java.support.component.ComponentInitializationException:
Error refreshing metadata during init
        at
org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver.initMetadataResolver(AbstractReloadingMetadataResolver.java:327)
Caused by:
net.shibboleth.utilities.java.support.resolver.ResolverException: Exception
during refresh
        at
org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver.refresh(AbstractReloadingMetadataResolver.java:378)
Caused by:
net.shibboleth.utilities.java.support.resolver.ResolverException: Unable to
read metadata from remote server and backup does not exist
        at
org.opensaml.saml.metadata.resolver.impl.FileBackedHTTPMetadataResolver.fetchMetadata(FileBackedHTTPMetadataResolver.java:318)
ERROR
[net.shibboleth.utilities.java.support.service.AbstractReloadableService:185]
[ ] - Service 'shibboleth.MetadataResolverService': No further attempts
will be made to reload

Then subsequently, when trying to authenticate to an unrelated SP:

ERROR
[net.shibboleth.idp.saml.metadata.impl.ReloadingRelyingPartyMetadataProvider:71]
[7E86F835FB677456435CDA2F258FF641 10.255.0.1] -
RelyingPartyMetadataProvider 'shibboleth.MetadataResolver': Error accessing
underlying metadata source: Invalid configuration.

Removing the one failing MetadataProvider and reloading the metadata
resolver service got things going again.

To my knowledge, we have not enabled failFast on the metadata service, or
on any other service. In services.properties, all the failFast values are
unspecified (eg
#idp.service.metadata.failFast = false and #idp.service.failFast = false).

Is there any way to avoid this sort of situation?

Thanks,

Max Spicer
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210720/dec62855/attachment.htm>