All requests blocked on FileBackedHTTPMetadataProvider for metadata at unreachable URL

[Osterptak, Jory]

Hello,

Shibboleth 5.1.2
Tomcat 10.1.26.0
RHEL 8

On our Shibboleth service, we found that intermittently any requests to our Shibboleth service would be fully blocked for about 60 seconds, resulting in connection timeouts. Thread dumps indicate that all request threads were BLOCKED on an org.opensaml.saml.metadata.resolver.impl.FileBackedHTTPMetadataResolver object. Browsing the logs, we determined that, one of our SP MetadataProviders of type FileBackedHTTPMetadataResolver encountered a connect timeout:
Error retrieving metadata from https://[REDACTED]/metadata.php: Connect to https://[REDACTED]:443 [[REDACTED]] failed: Connect timed out
My concern is that all other requests were blocked for 60 seconds while the shibboleth service attempted to load the metadata for this SP. However, it seems unwise that an issue retrieving metadata can cause the entire application to be blocked for 60 seconds. Is anyone aware of how to avoid this issue?

If it matters, the metadata for this SP is configured within a ChainingMetadataProvider:
<MetadataProvider id="ShibbolethMetadata" xsi:type="ChainingMetadataProvider"
   ...
   <MetadataProvider id="[REDACTED]"
       xsi:type="FileBackedHTTPMetadataProvider"
       backingFile="%{idp.home}/metadata/[REDACTED].xml"
       metadataURL="https://[REDACTED]/metadata.php"
       />
   ...
</MetadataProvider>
Thanks,
Jory

---
Jory Osterptak (he/him/his)
Senior Systems Engineer
University IT
University of Rochester
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241106/d98b7526/attachment.htm>