[EXT] RE: Shibboleth stopped working

[Mittel, Don]

I had not yet switched to the MDQ protocol yet, i was just reading about that.  We are still using the old method for the metadata, but changing the maxValidityInterval from 14 to 21 has resolved our issue.  Thank you.

Going to look into switching over to the MDQ and will make sure to set it for 21 days.
________________________________
From: Mizushima, Marcus <mmizushima at calstate.edu>
Sent: Monday, February 17, 2025 7:07 PM
To: Shib Users <users at shibboleth.net>
Cc: Mittel, Don <dmittel at depaul.edu>
Subject: [EXT] RE: Shibboleth stopped working

You don't often get email from mmizushima at calstate.edu. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>

Check your IdP metadata provider setting for InCommon metadata. If it is configured to use the InCommon aggregate instead of using the MDQ protocol, then check if you have set a RequiredValidUntil metadata filter. If the maxValidityInterval is set to 14 days (P14D or some other time unit equivalent), you’ll want to temporarily increase that to 21 days. This is because recently the InCommon aggregate was published with a validUntil date 3 weeks in the future, instead of 2 weeks.



You can also confirm that this is the issue if you see messages like this in your idp-process.log:



ERROR [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:376] - Metadata Resolver FileBackedHTTPMetadataResolver incommonaggregate: Error occurred while attempting to refresh metadata from 'https://mdq.incommon.org/entities'

net.shibboleth.utilities.java.support.resolver.ResolverException: Error filtering metadata from https://mdq.incommon.org/entities

                at org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver.processNonExpiredMetadata(AbstractReloadingMetadataResolver.java:552)

Caused by: org.opensaml.saml.metadata.resolver.filter.FilterException: Metadata's validity interval PT502H50M7.901S is larger than is allowed PT336H

                at org.opensaml.saml.metadata.resolver.filter.impl.RequiredValidUntilFilter.filter(RequiredValidUntilFilter.java:97)



HTH,



Marcus Mizushima

Identity Management Analyst

California State University, Office of the Chancellor



From: users <users-bounces at shibboleth.net> On Behalf Of Mittel, Don via users
Sent: Monday, February 17, 2025 4:46 PM
To: Shib Users <users at shibboleth.net>
Cc: Mittel, Don <dmittel at depaul.edu>
Subject: Shibboleth stopped working



Shibboleth was working find until earlier today when all of the sudden my servers started reporting errors like this: 2025-02-17 17: 41: 02,722 - WARN [org. opensaml. saml. metadata. resolver. impl. AbstractMetadataResolver: 551] - FileBackedHTTPMetadataResolver

Shibboleth was working find until earlier today when all of the sudden my servers started reporting errors like this:



2025-02-17 17:41:02,722 - WARN [org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:551] - FileBackedHTTPMetadataResolver ICMD: Metadata backing store contained an EntityDescriptor with the ID: https://depaul-sa.terradotta.com/sp/shibboleth<https://urldefense.com/v3/__https:/depaul-sa.terradotta.com/sp/shibboleth__;!!MWueTNF2!UUWjYdTqkZ5l9Gc_3GYfmI0NBtK-wROLfe6f9OnvwawRS4PdvekAuHWx6WIpIoYoipQpSI6YokaWXJWwpf9dUdE$>,  but it was no longer valid

2025-02-17 17:41:02,722 - INFO [org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler:185] - Message Handler:  No metadata returned for https://depaul-sa.terradotta.com/sp/shibboleth<https://urldefense.com/v3/__https:/depaul-sa.terradotta.com/sp/shibboleth__;!!MWueTNF2!UUWjYdTqkZ5l9Gc_3GYfmI0NBtK-wROLfe6f9OnvwawRS4PdvekAuHWx6WIpIoYoipQpSI6YokaWXJWwpf9dUdE$> in role {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor with protocol urn:oasis:names:tc:SAML:2.0:protocol

2025-02-17 17:41:02,722 - WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:164] - Profile Action SelectProfileConfiguration: Profile http://shibboleth.net/ns/profiles/saml2/sso/browser<https://urldefense.com/v3/__http:/shibboleth.net/ns/profiles/saml2/sso/browser__;!!MWueTNF2!UUWjYdTqkZ5l9Gc_3GYfmI0NBtK-wROLfe6f9OnvwawRS4PdvekAuHWx6WIpIoYoipQpSI6YokaWXJWwiOKxibM$> is not available for RP configuration shibboleth.UnverifiedRelyingParty (RPID https://depaul-sa.terradotta.com/sp/shibboleth<https://urldefense.com/v3/__https:/depaul-sa.terradotta.com/sp/shibboleth__;!!MWueTNF2!UUWjYdTqkZ5l9Gc_3GYfmI0NBtK-wROLfe6f9OnvwawRS4PdvekAuHWx6WIpIoYoipQpSI6YokaWXJWwpf9dUdE$>)

2025-02-17 17:41:02,722 - WARN [org.opensaml.profile.action.impl.LogEvent:94] - A non-proceed event occurred while processing the request: InvalidProfileConfiguration



Now any time we try to access a relying party we get this error:



Unsupported Request

The application you have accessed is not registered for use with this service.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250218/8932cf2b/attachment.htm>