Jetty unresponsive for shibboleth IDP requests

[Dewi Aled JONES]

Update to this, issue has been found and fixed. The problem was that a deprecated system was still defined in the metadata-providers.xml. Removing it fixed the issue (old url was redirected elsewhere causing timeout as far as I can tell.)




________________________________
From: users <users-bounces at shibboleth.net> on behalf of Dewi Aled JONES via users <users at shibboleth.net>
Sent: 20 May 2025 10:28:48
To: users at shibboleth.net
Cc: Dewi Aled JONES
Subject: Jetty unresponsive for shibboleth IDP requests

[EXTERNAL EMAIL - USE CAUTION when clicking links or attachments]


Hello all,

I have very little experience with shibboleth, and need to fix an urgent problem while the person who normally maintains the system is away.


The IDP system was working fine for many weeks but suddenly stopped responding one morning. The IDP URL timedout.

Restarting Jetty service brought the IDP back responsive, but after approx. 15mins, same issue occurred.

I also see that even after a jetty restart some of our services cannot authenticate, they just hang waiting for IDP, whilst others redirect to IDP and allow login.


As a workaround, Ive set a cronjob to restart jetty every 30mins. but as noted above, this only allows auth to some of our services, not all.


Details:


cat /opt/jetty-base-idp/jetty.state
INIT StateLifeCycleListener at 662b4c69
STARTING oejs.Server at 5a7fe64f{STARTING}[12.0.16,sto=0]
STARTED oejs.Server at 5a7fe64f{STARTED}[12.0.16,sto=0]


/opt/shibboleth-idp/bin/version.sh
5.1.3



cat /etc/debian_version
11.10

There is nothing obvious in the 'idp-process.log' or the 'jetty.log'.

An external partner with many years experience with shibboleth has had a look for a few hours, but was unable to find the problem.


In our configuration, we define each metadata instead of an automatic directory config, but this has been ok for many years. (just over 100 metadata definitions).


Running '/opt/shibboleth-idp/bin/status.sh' never completes, perhaps this gives a clue?


Any troubleshooting tips appreciated.


Many thanks!

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250520/f766d606/attachment.htm>