problems with LocalDynamicMetadataResolver and shibb 5.1.6 on rocky9 (tier container)

[Nathan Christopher Lewan]

hello,

having a strange issue with testing the 5.1.6 update. We use the tier
docker containers, and noticed with the 5.1.6 update it was mentioned the
rocky8 OS variant was going away in favor of rocky9/10

So I flipped my testing over to the 5.1.6 rocky9 tier container, and my
metadata-providers.xml LocalDynamicMetadataResolver entries stopped
working. They were working just fine under rocky8.
FilesystemMetadataProviders work just fine, but they are a
little unwieldy in our setup.

I noticed in the rocky9 release notes they updated openssl, and depreciated
sha1 for cryptographic uses. I did remember
that the LocalDynamicMetadataResolver does use sha1 to resolve digested
entityIDs from a sourceDirectory. Don't think the sha1 piece is related,
more of an interesting coincidence.

So I did some testing.

these will be bogus strings, but the idea is the same:

I have saml metadata in a directory with an entityID of '
http://localtest.site.edu:8091/sso/metadata' in a file called
'localtest_site_edu.xml'

I have a LocalDynamicMetadataResolver pointing at the directory.

When I run debug logs in shibb and try and authenticate with the SP, I get
messages like this:


------ LOGS FROM 5.1.6 running on rocky9 with LocalDynamicMetadataResolver
------

LocalDynamicMetadataResolver OurLocalMetadataProvider: Resolving metadata
dynamically for entity ID: http://localtest.site.edu:8091/sso/metadata

DEBUG [net.shibboleth.shared.codec.StringDigester:156] - Digesting input '
http://localtest.site.edu:8091/sso/metadata' as charset 'UTF-8' with digest
algorithm 'SHA-1' and output format 'HEX_LOWER'

DEBUG [net.shibboleth.shared.codec.StringDigester:178] - Produced digested
and formatted output 'f4325ed353dcc638925265e7aa47b6dc457b77a4'

TRACE
[org.opensaml.saml.metadata.resolver.impl.LocalDynamicMetadataResolver:118]
- LocalDynamicMetadataResolver OurLocalMetadataProvider: Attempting to load
from local source manager with generated key
'f4325ed353dcc638925265e7aa47b6dc457b77a4.xml'

TRACE
[org.opensaml.saml.metadata.resolver.impl.LocalDynamicMetadataResolver:124]
- LocalDynamicMetadataResolver OurLocalMetadataProvider: Found no target in
local source manager with key 'f4325ed353dcc638925265e7aa47b6dc457b77a4.xml'

DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractDynamicMetadataResolver:821]
- LocalDynamicMetadataResolver OurLocalMetadataProvider: No metadata was
fetched from the origin source

DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:542] -
LocalDynamicMetadataResolver OurLocalMetadataProvider: Metadata backing
store does not contain any EntityDescriptors with the ID:
http://localtest.site.edu:8091/sso/metadata

DEBUG
[org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:708] -
LocalDynamicMetadataResolver OurLocalMetadataProvider: Candidates iteration
was empty, nothing to filter via predicates

------

When I go look on the running container filesystem for 5.1.6 running
rocky9, I see the digested file referencing the metadata file I mentioned
above is this:

f2743c7e3c397a27ceec8a2950f1a9994c1c3496.xml -> localtest_site_edu.xml

which doesn't match.

when I use the rocky8 image, both the logs and the container filesystem
match with this:
f4325ed353dcc638925265e7aa47b6dc457b77a4.xml -> localtest_site_edu.xml

------ LOGS FROM 5.1.6 running on rocky8 ------

LocalDynamicMetadataResolver OurLocalMetadataProvider: Resolving metadata
dynamically for entity ID: http://localtest.site.edu.edu:8091/sso/metadata

DEBUG [net.shibboleth.shared.codec.StringDigester:156] - Digesting input '
http://localtest.site.edu.edu:8091/sso/metadata' as charset 'UTF-8' with
digest algorithm 'SHA-1' and output format 'HEX_LOWER'

DEBUG [net.shibboleth.shared.codec.StringDigester:178] - Produced digested
and formatted output 'f4325ed353dcc638925265e7aa47b6dc457b77a4'

TRACE
[org.opensaml.saml.metadata.resolver.impl.LocalDynamicMetadataResolver:118]
- LocalDynamicMetadataResolver OurLocalMetadataProvider: Attempting to load
from local source manager with generated key
'f4325ed353dcc638925265e7aa47b6dc457b77a4.xml'

TRACE
[org.opensaml.saml.metadata.resolver.impl.LocalDynamicMetadataResolver:121]
- LocalDynamicMetadataResolver OurLocalMetadataProvider: Successfully
loaded target from local source manager source with key
'f4325ed353dcc638925265e7aa47b6dc457b77a4.xml' of type:
{urn:oasis:names:tc:SAML:2.0:metadata}EntityDescriptor
------

I have tried with multiple metadata files, all that work except with
rocky9. I verified the metadata files are UTF8 with LF endings.

I am wondering if there is some sensitivity in string reading that is
occuring in one process (generating the symlink digest file), and not the
other(recomputing and searching for it), but I have no idea about that
process, or if how i've outlined it above with two separate parts is even
accurate.

Any thoughts?

**
Nathan Lewan
IT Engineer - Identity and Access Management
Division of Information Technology
University of Maryland
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250925/d7f9a9d1/attachment.htm>