Troubleshooting Sibboleth Idp 4.3.1 - No Metadata Resolver has ever attempted a reload

[El Manaa Amine]

This is conf/metadata-resolvers.xml (see below). What do you mean with "explicitly non-reloading resolvers" . Sorry I'm still beginning with Sibboleth but my understanding is that wen you have a FileBackedHTTPMetadataProvider , Shibboleth should fetch the metadata from the remote endpoint and store the metadata locally? 

In another installation, with the same metadata-resolvers.xml, I can see this output (All the metadata sources are shown) when I call the status endpoint. Why don't I get the same output ?

service: shibboleth.MetadataResolverService
last successful reload attempt: 2023-10-17T05:06:11.120049031Z
last reload attempt: 2023-10-17T05:06:11.120049031Z

        metadata source: ShibbolethMetadata
        last refresh attempt: 2023-10-17T14:06:34.521562229Z
        last successful refresh: 2023-10-17T14:06:34.521562229Z
        last update: 2023-10-17T14:06:20.536405659Z

        metadata source: URLMD
        last refresh attempt: 2023-10-17T14:06:12.500799876Z
        last successful refresh: 2023-10-17T14:06:12.500799876Z
        last update: 2023-10-17T14:06:12.500799876Z
        root validUntil: 2023-10-25T12:14:10Z

        metadata source: URLMD4
        last refresh attempt: 2023-10-17T14:06:20.536405659Z
        last successful refresh: 2023-10-17T14:06:20.536405659Z
        last update: 2023-10-17T14:06:20.536405659Z
        root validUntil: 2023-10-22T13:32:56Z

        metadata source: AzureAD-idp-metadata
        last refresh attempt: 2023-10-17T14:06:27.228633275Z
        last successful refresh: 2023-10-17T14:06:27.228633275Z
        last update: 2023-10-17T05:06:27.225225029Z

        metadata source: SAMLtest
        last refresh attempt: 2023-10-17T14:06:34.521562229Z
        last successful refresh: 2023-10-17T14:06:34.521562229Z
        last update: 2023-10-17T05:06:32.278538779Z
        root validUntil: 2100-01-01T00:00:42Z


conf/metadata-resolvers.xml

<?xml version="1.0" encoding="UTF-8"?>
<MetadataProvider id="ShibbolethMetadata" xsi:type="ChainingMetadataProvider"
 xmlns="urn:mace:shibboleth:2.0:metadata"
 xmlns:security="urn:mace:shibboleth:2.0:security"
 xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
 xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
 xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport"
 xmlns:ds="http://www.w3.org/2000/09/xmldsig#"
 xmlns:ds11="http://www.w3.org/2009/xmldsig11#"
 xmlns:enc="http://www.w3.org/2001/04/xmlenc#"
 xmlns:enc11="http://www.w3.org/2009/xmlenc11#"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="urn:mace:shibboleth:2.0:metadata
http://shibboleth.net/schema/idp/shibboleth-metadata.xsd
 urn:mace:shibboleth:2.0:security http://shibboleth.net/schema/idp/shibboleth-security.xsd
 urn:oasis:names:tc:SAML:2.0:assertion
http://docs.oasis-open.org/security/saml/v2.0/saml-schema-assertion-2.0.xsd
 urn:oasis:names:tc:SAML:2.0:metadata
http://docs.oasis-open.org/security/saml/v2.0/saml-schema-metadata-2.0.xsd
 urn:oasis:names:tc:SAML:metadata:algsupport
http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-metadata-algsupport-v1.0.xsd
 http://www.w3.org/2000/09/xmldsig# http://www.w3.org/TR/2002/REC-xmldsig-core-20020212/xmldsig-core-schema.xsd
 http://www.w3.org/2009/xmldsig11# http://www.w3.org/TR/2013/REC-xmldsig-core1-20130411/xmldsig11-schema.xsd
 http://www.w3.org/2001/04/xmlenc# http://www.w3.org/TR/xmlenc-core/xenc-schema.xsd
 http://www.w3.org/2009/xmlenc11# http://www.w3.org/TR/2013/REC-xmlenc-core1-20130411/xenc-schema-11.xsd"
 sortKey="1">

    <!-- ******* Belnet Federation ******* -->
    <MetadataProvider id="URLMD"
                      xsi:type="FileBackedHTTPMetadataProvider"
                      backingFile="%{idp.home}/metadata/belnet-refed-metadata.xml"
                      metadataURL="https://federation.belnet.be/metadata/re/metadata.xml">
        <MetadataFilter xsi:type="SignatureValidation"
                        certificateFile="${idp.home}/credentials/certificate.federation.belnet.be.crt"
                        requireSignedRoot="false">
        </MetadataFilter>
        <MetadataFilter xsi:type="EntityRole">
            <RetainedRole>md:SPSSODescriptor</RetainedRole>
        </MetadataFilter>
    </MetadataProvider>

    <!-- ******* eduGAIN Federation ******* -->
    <MetadataProvider id="URLMD4" xsi:type="FileBackedHTTPMetadataProvider"
                      xmlns="urn:mace:shibboleth:2.0:metadata"
                      metadataURL="https://mds.edugain.org/edugain-v2.xml"
                      backingFile="%{idp.home}/metadata/mds.edugain.org.xml">
        <MetadataFilter xsi:type="SignatureValidation"
                        certificateFile="${idp.home}/credentials/edugain.crt"
                        requireSignedRoot="false">
        </MetadataFilter>
        <MetadataFilter xsi:type="EntityRole">
            <RetainedRole>md:SPSSODescriptor</RetainedRole>
        </MetadataFilter>
    </MetadataProvider>

    <!-- ******* Azure AD ******* -->
    <MetadataProvider id="AzureAD-idp-metadata"
                      xsi:type="FilesystemMetadataProvider"
                      metadataFile="%{idp.home}/metadata/AzureAD-idp.xml" />

    <!-- ******* Compilatio SP ******* -->
    <MetadataProvider id="sp-shib-compilatio" xsi:type="FilesystemMetadataProvider" metadataFile="%{idp.home}/metadata/sp-compilatio-metadata.xml" />
    <!-- ******* SAMLTest SP ******* -->
    <MetadataProvider id="SAMLtest" xsi:type="FileBackedHTTPMetadataProvider" backingFile="%{idp.home}/metadata/sp-samltest-metadata.xml"  metadataURL="https://samltest.id/saml/sp">
        <!-- You should always check the signature and freshness of remote
              metadata.  It's commented out until you get the basics working.
           <MetadataFilter xsi:type="SignatureValidation"
                  certificateFile="%{idp.home}/credentials/signet.crt" />
           <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P30D"/>
        -->
   </MetadataProvider>

</MetadataProvider>

-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu> 
Sent: mardi 17 octobre 2023 18:10
To: Shib Users <users at shibboleth.net>
Cc: El Manaa Amine <amine.elmanaa.ext at i-city.brucity.be>
Subject: Re: Troubleshooting Sibboleth Idp 4.3.1 - No Metadata Resolver has ever attempted a reload


I would imagine it means what it says, that there is no metadata in there to do anything with, or they're all explicitly non-reloading resolvers.

-- Scott