[EXT] RE: Shibboleth stopped working

Tue Feb 18 02:53:02 UTC 2025

Thank you, Don, and Marcus. Shib was down for us all afternoon as well, and we were scratching our heads on this as well. Your solution worked for us too, and our services are now back up.

An example of the error message we were seeing in our logs, was:

2025-02-17 17:04:16,188 - 76.158.161.39 - WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:117] - Profile Action SelectProfileConfiguration: Profile http://shibboleth.net/ns/profiles/saml2/sso/browser is not available for RP configuration shibboleth.UnverifiedRelyingParty (RPID https://sp.eblib.com/shibboleth)
2025-02-17 17:04:16,188 - 76.158.161.39 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: InvalidProfileConfiguration

Changing the maxValidityInterval from 14 to 21 has resolved our issue here, but we're curious as to what changed until this afternoon. If any of you have any info about what went wrong here and how to prevent this from happening, any pointers would be much appreciated!

Thanks,

Prasad

________________________________
From: users on behalf of Mittel, Don via users
Sent: Monday, February 17, 2025 5:36 PM
To: Mizushima, Marcus; Shib Users
Cc: Mittel, Don
Subject: Re: [EXT] RE: Shibboleth stopped working

Good to know. I'm going to be looking into getting switched over to that to try and about this issue in the future.

Thanks again.
Don

________________________________
From: Mizushima, Marcus <mmizushima at calstate.edu>
Sent: Monday, February 17, 2025 7:29:10 PM
To: Mittel, Don <dmittel at depaul.edu>; Shib Users <users at shibboleth.net>
Subject: RE: [EXT] RE: Shibboleth stopped working

You don't often get email from mmizushima at calstate.edu. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification>

FWIW: If you’re using MDQ the metadata returned by that protocol does have the validUntil set for 2 weeks as expected.

From: Mittel, Don <dmittel at depaul.edu>
Sent: Monday, February 17, 2025 5:15 PM
To: Mizushima, Marcus <mmizushima at calstate.edu>; Shib Users <users at shibboleth.net>
Subject: Re: [EXT] RE: Shibboleth stopped working

I had not yet switched to the MDQ protocol yet, i was just reading about that. We are still using the old method for the metadata, but changing the maxValidityInterval from 14 to 21 has resolved our issue. Thank you. Going to look into switching

I had not yet switched to the MDQ protocol yet, i was just reading about that.  We are still using the old method for the metadata, but changing the maxValidityInterval from 14 to 21 has resolved our issue.  Thank you.

Going to look into switching over to the MDQ and will make sure to set it for 21 days.

________________________________

From: Mizushima, Marcus <mmizushima at calstate.edu<mailto:mmizushima at calstate.edu>>
Sent: Monday, February 17, 2025 7:07 PM
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Cc: Mittel, Don <dmittel at depaul.edu<mailto:dmittel at depaul.edu>>
Subject: [EXT] RE: Shibboleth stopped working

You don't often get email from mmizushima at calstate.edu<mailto:mmizushima at calstate.edu>. Learn why this is important<https://urldefense.com/v3/__https:/aka.ms/LearnAboutSenderIdentification__;!!MWueTNF2!Q8hDmktJ0wscZHLdJyKTLZBQP5XKDLH4UrdXaeuLlqrUR5Pc6xn7C7yzZU3fMdmn0kk746YMwVFP_-cpia-Rgpmm$>

Check your IdP metadata provider setting for InCommon metadata. If it is configured to use the InCommon aggregate instead of using the MDQ protocol, then check if you have set a RequiredValidUntil metadata filter. If the maxValidityInterval is set to 14 days (P14D or some other time unit equivalent), you’ll want to temporarily increase that to 21 days. This is because recently the InCommon aggregate was published with a validUntil date 3 weeks in the future, instead of 2 weeks.

You can also confirm that this is the issue if you see messages like this in your idp-process.log:

ERROR [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:376] - Metadata Resolver FileBackedHTTPMetadataResolver incommonaggregate: Error occurred while attempting to refresh metadata from 'https://mdq.incommon.org/entities<https://urldefense.com/v3/__https:/mdq.incommon.org/entities__;!!MWueTNF2!Q8hDmktJ0wscZHLdJyKTLZBQP5XKDLH4UrdXaeuLlqrUR5Pc6xn7C7yzZU3fMdmn0kk746YMwVFP_-cpibzQ393J$>'

net.shibboleth.utilities.java.support.resolver.ResolverException: Error filtering metadata from https://mdq.incommon.org/entities<https://urldefense.com/v3/__https:/mdq.incommon.org/entities__;!!MWueTNF2!Q8hDmktJ0wscZHLdJyKTLZBQP5XKDLH4UrdXaeuLlqrUR5Pc6xn7C7yzZU3fMdmn0kk746YMwVFP_-cpibzQ393J$>

                at org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver.processNonExpiredMetadata(AbstractReloadingMetadataResolver.java:552)

Caused by: org.opensaml.saml.metadata.resolver.filter.FilterException: Metadata's validity interval PT502H50M7.901S is larger than is allowed PT336H

                at org.opensaml.saml.metadata.resolver.filter.impl.RequiredValidUntilFilter.filter(RequiredValidUntilFilter.java:97)

HTH,

Marcus Mizushima

Identity Management Analyst

California State University, Office of the Chancellor

From: users <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>> On Behalf Of Mittel, Don via users
Sent: Monday, February 17, 2025 4:46 PM
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Cc: Mittel, Don <dmittel at depaul.edu<mailto:dmittel at depaul.edu>>
Subject: Shibboleth stopped working

Shibboleth was working find until earlier today when all of the sudden my servers started reporting errors like this: 2025-02-17 17: 41: 02,722 - WARN [org. opensaml. saml. metadata. resolver. impl. AbstractMetadataResolver: 551] - FileBackedHTTPMetadataResolver

Shibboleth was working find until earlier today when all of the sudden my servers started reporting errors like this:

2025-02-17 17:41:02,722 - WARN [org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:551] - FileBackedHTTPMetadataResolver ICMD: Metadata backing store contained an EntityDescriptor with the ID: https://depaul-sa.terradotta.com/sp/shibboleth<https://urldefense.com/v3/__https:/depaul-sa.terradotta.com/sp/shibboleth__;!!MWueTNF2!UUWjYdTqkZ5l9Gc_3GYfmI0NBtK-wROLfe6f9OnvwawRS4PdvekAuHWx6WIpIoYoipQpSI6YokaWXJWwpf9dUdE$>,  but it was no longer valid

2025-02-17 17:41:02,722 - INFO [org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler:185] - Message Handler:  No metadata returned for https://depaul-sa.terradotta.com/sp/shibboleth<https://urldefense.com/v3/__https:/depaul-sa.terradotta.com/sp/shibboleth__;!!MWueTNF2!UUWjYdTqkZ5l9Gc_3GYfmI0NBtK-wROLfe6f9OnvwawRS4PdvekAuHWx6WIpIoYoipQpSI6YokaWXJWwpf9dUdE$> in role {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor with protocol urn:oasis:names:tc:SAML:2.0:protocol

2025-02-17 17:41:02,722 - WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:164] - Profile Action SelectProfileConfiguration: Profile http://shibboleth.net/ns/profiles/saml2/sso/browser<https://urldefense.com/v3/__http:/shibboleth.net/ns/profiles/saml2/sso/browser__;!!MWueTNF2!UUWjYdTqkZ5l9Gc_3GYfmI0NBtK-wROLfe6f9OnvwawRS4PdvekAuHWx6WIpIoYoipQpSI6YokaWXJWwiOKxibM$> is not available for RP configuration shibboleth.UnverifiedRelyingParty (RPID https://depaul-sa.terradotta.com/sp/shibboleth<https://urldefense.com/v3/__https:/depaul-sa.terradotta.com/sp/shibboleth__;!!MWueTNF2!UUWjYdTqkZ5l9Gc_3GYfmI0NBtK-wROLfe6f9OnvwawRS4PdvekAuHWx6WIpIoYoipQpSI6YokaWXJWwpf9dUdE$>)

2025-02-17 17:41:02,722 - WARN [org.opensaml.profile.action.impl.LogEvent:94] - A non-proceed event occurred while processing the request: InvalidProfileConfiguration

Now any time we try to access a relying party we get this error:

Unsupported Request

The application you have accessed is not registered for use with this service.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250218/5fd9a750/attachment.htm>