SP downloading and xmldsig-validating remote XML metadata on every start

[Peter Schober]

* Scott Cantor <cantor.2 at osu.edu> [2023-03-17 19:20]:
> However, at startup the foregrounded init process loads the backup
> file and would omit the signature check. The background refresh
> thread would immediately be started and would be doing work (and
> tying up lots of CPU), it just shouldn't prevent the overall startup
> sequence from finishing or handling requests as long as it has the
> cycles.

Hm, before the signature validation filter finishes there's
definitively no activity in the log, at least:

2023-03-17 17:33:24 INFO OpenSAML.MetadataProvider : applying metadata filter (Signature)
2023-03-17 17:37:10 INFO OpenSAML.MetadataProvider : applying metadata filter (EntityRole)
2023-03-17 17:37:11 DEBUG OpenSAML.MetadataProvider.XML : committing backup file to permanent location (/var/cache/shibboleth/metadata.xml)
[...]
2023-03-17 17:37:11 INFO Shibboleth.Listener : listener service starting

And while the signature filter is being applied there's no UNIX socket
to connect to:

$ nc -vU /run/shibboleth/shibd.sock
nc: unix connect failed: No such file or directory
nc: /run/shibboleth/shibd.sock: No such file or directory

I.e., it's not just the log line about "listener service starting"
that comes well after the signature validation filter finishes, shibd
is actually not listening before.

-peter