SP downloading and xmldsig-validating remote XML metadata on every start

[Peter Schober]

* Scott Cantor <cantor.2 at osu.edu> [2023-03-17 20:18]:
> I can say from the log that it's clear that the reason the setting
> isn't mattering is that it isn't loading the backup file there, it's
> clear from the log that there's a curl fetch of the file ahead of
> that step.

OK, thanks. I was running shibd on DEBUG but hadn't checked the code
itself to see what if anything about the backup file would be logged.
There certainly was nothing about it being absent or unusable.

> The main function of the backup originally of course was as a
> fallback for errors, but I really can't see why the setting would
> have been added at all if not for the intent that it would
> initialize from the backup file if it were present. [...]
> 
> It just hasn't changed in several years

I wasn't trying to imply it was (changed) and my own recollection was
certainly that this did/does work. So I'm assuming something's off in
my deployment. (The only thing unusual about it being is that it
doesn't have a web server installed, but that shouldn't matter.)

* Scott Cantor <cantor.2 at osu.edu> [2023-03-17 20:35]:
> One caution, but I don't think this was what you said you did, is
> that the -t option to test it does not do the backgrounding thing,
> it will do the normal thing and load the remote file if it can, not
> use the backup.

Thanks but indeed I'm not using -t. I'm starting shibd using the
Debian-packaged systemd service unit. I've also used an equivalent
command outside of systemd (as determined by looking at the process
table of the service when started under systemd), e.g. as root:

  setuidgid _shibd /usr/sbin/shibd -f -F LANG=C.UTF-8 \
    PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin \
    HOME=/var/log/shibboleth LOGNAME=_shibd USER=_shibd

Unless someone else from the community beats me to it or can share
their experience with this setting I guess I'll create a Rocky-based
VM and try again there.

-peter