Shib IdP v5.1.3 - Upgrade issue with ArtifactResolutionService in metadata files

Hall, Gerry gerry.hall at emory.edu
Wed Sep 25 19:28:31 UTC 2024


I am upgrading from IdP v 4.3.3. to IdP v5.1.3 and installing v5.1.3 on top of v4.3.3.  Prior to the upgrade, v4.3.3 runs as expected.  I have updated all plugins, removed all deprecated warning messages, etc.  I am using amazon-corretto-17-aarch64-linux-jdk.tar.gz and apache-tomcat-10.1.2.   I run the update with no issues.

However, after the upgrade, when I start the IdP, I get errors like the below which point to lines like this
‘<md:ArtifactResolutionService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location=https://osnode01.rwit.emory.edu/Shibboleth.sso/Artifact/SOAP index="1"/>’
in the service provider metadata files.

I am not sure that this is the best solution, but to test, I have removed the line from the metadata file.  When I then restart the IdP, the error disappears for that SP.  However, I have over 340 metadata files with the ‘ArtifactResolutionService’ line, and I would need to remove that line from all 340 metadata files.

My question is (1) is there a better way to resolve this error and (2.) what are the implications of removing ArtifactResolutionService in the SP SAML metadata file?  I have also read the doc here, https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2065334690/ArtifactResolutionService .

(ERROR)
    2024-09-25 14:01:08,339 -  -  - ERROR [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:493] -
    FilesystemMetadataResolver OrEmoryEduMD: Unable to unmarshall metadata: o
    rg.opensaml.core.xml.io.UnmarshallingException:
    Saw invalid child element {urn:oasis:names:tc:SAML:2.0:metadata}ArtifactResolutionService
    on parent {urn:oasis:names:tc:SAML:2.0:metadata}EntityDescriptor

    2024-09-25 14:01:08,339 -  -  - ERROR [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:396]
     FilesystemMetadataResolver OrEmoryEduMD:
     Error occurred while attempting to refresh metadata
     from '/opt/shibboleth-idp/metadata/orEmoryEdu-metadata.xml'
    net.shibboleth.shared.resolver.ResolverException: Unable to unmarshall metadata
                at org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver.unmarshallMetadata(AbstractReloadingMetadataResolver.java:494)

    Caused by: org.opensaml.core.xml.io.UnmarshallingException: org.opensaml.core.xml.io.UnmarshallingException:
    Saw invalid child element {urn:oasis:names:tc:SAML:2.0:metadata}ArtifactResolutionService
    on parent {urn:oasis:names:tc:SAML:2.0:metadata}EntityDescriptor
                at org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver.unmarshallMetadata(AbstractMetadataResolver.java:442)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240925/43ac4a4f/attachment.htm>


More information about the users mailing list