Shibboleth stopped working

[Mizushima, Marcus]

Check your IdP metadata provider setting for InCommon metadata. If it is configured to use the InCommon aggregate instead of using the MDQ protocol, then check if you have set a RequiredValidUntil metadata filter. If the maxValidityInterval is set to 14 days (P14D or some other time unit equivalent), you’ll want to temporarily increase that to 21 days. This is because recently the InCommon aggregate was published with a validUntil date 3 weeks in the future, instead of 2 weeks.

You can also confirm that this is the issue if you see messages like this in your idp-process.log:

ERROR [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:376] - Metadata Resolver FileBackedHTTPMetadataResolver incommonaggregate: Error occurred while attempting to refresh metadata from 'https://mdq.incommon.org/entities'
net.shibboleth.utilities.java.support.resolver.ResolverException: Error filtering metadata from https://mdq.incommon.org/entities
                at org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver.processNonExpiredMetadata(AbstractReloadingMetadataResolver.java:552)
Caused by: org.opensaml.saml.metadata.resolver.filter.FilterException: Metadata's validity interval PT502H50M7.901S is larger than is allowed PT336H
                at org.opensaml.saml.metadata.resolver.filter.impl.RequiredValidUntilFilter.filter(RequiredValidUntilFilter.java:97)

HTH,

Marcus Mizushima
Identity Management Analyst
California State University, Office of the Chancellor

From: users <users-bounces at shibboleth.net> On Behalf Of Mittel, Don via users
Sent: Monday, February 17, 2025 4:46 PM
To: Shib Users <users at shibboleth.net>
Cc: Mittel, Don <dmittel at depaul.edu>
Subject: Shibboleth stopped working

Shibboleth was working find until earlier today when all of the sudden my servers started reporting errors like this: 2025-02-17 17: 41: 02,722 - WARN [org. opensaml. saml. metadata. resolver. impl. AbstractMetadataResolver: 551] - FileBackedHTTPMetadataResolver

Shibboleth was working find until earlier today when all of the sudden my servers started reporting errors like this:

2025-02-17 17:41:02,722 - WARN [org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:551] - FileBackedHTTPMetadataResolver ICMD: Metadata backing store contained an EntityDescriptor with the ID: https://depaul-sa.terradotta.com/sp/shibboleth<https://urldefense.com/v3/__https:/depaul-sa.terradotta.com/sp/shibboleth__;!!MWueTNF2!UUWjYdTqkZ5l9Gc_3GYfmI0NBtK-wROLfe6f9OnvwawRS4PdvekAuHWx6WIpIoYoipQpSI6YokaWXJWwpf9dUdE$>,  but it was no longer valid
2025-02-17 17:41:02,722 - INFO [org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler:185] - Message Handler:  No metadata returned for https://depaul-sa.terradotta.com/sp/shibboleth<https://urldefense.com/v3/__https:/depaul-sa.terradotta.com/sp/shibboleth__;!!MWueTNF2!UUWjYdTqkZ5l9Gc_3GYfmI0NBtK-wROLfe6f9OnvwawRS4PdvekAuHWx6WIpIoYoipQpSI6YokaWXJWwpf9dUdE$> in role {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor with protocol urn:oasis:names:tc:SAML:2.0:protocol
2025-02-17 17:41:02,722 - WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:164] - Profile Action SelectProfileConfiguration: Profile http://shibboleth.net/ns/profiles/saml2/sso/browser<https://urldefense.com/v3/__http:/shibboleth.net/ns/profiles/saml2/sso/browser__;!!MWueTNF2!UUWjYdTqkZ5l9Gc_3GYfmI0NBtK-wROLfe6f9OnvwawRS4PdvekAuHWx6WIpIoYoipQpSI6YokaWXJWwiOKxibM$> is not available for RP configuration shibboleth.UnverifiedRelyingParty (RPID https://depaul-sa.terradotta.com/sp/shibboleth<https://urldefense.com/v3/__https:/depaul-sa.terradotta.com/sp/shibboleth__;!!MWueTNF2!UUWjYdTqkZ5l9Gc_3GYfmI0NBtK-wROLfe6f9OnvwawRS4PdvekAuHWx6WIpIoYoipQpSI6YokaWXJWwpf9dUdE$>)
2025-02-17 17:41:02,722 - WARN [org.opensaml.profile.action.impl.LogEvent:94] - A non-proceed event occurred while processing the request: InvalidProfileConfiguration

Now any time we try to access a relying party we get this error:

Unsupported Request
The application you have accessed is not registered for use with this service.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250218/0278ba53/attachment.htm>