Problem to download signed metadata from keycloak.

[Joakim Westlund]

The logs says

2026-05-15 14:12:37 DEBUG OpenSAML.MetadataProvider.XML : remote metadata
resource will be backed up to
(/var/cache/shibboleth/metadata-internal.xml.8d0b)
2026-05-15 14:12:37 DEBUG OpenSAML.MetadataProvider.XML : reload thread
started...running every 7200 seconds
2026-05-15 14:12:37 DEBUG OpenSAML.MetadataProvider.XML : loading
configuration from external resource...
2026-05-15 14:12:37 DEBUG OpenSAML.MetadataProvider.XML : writing to
backing file: /var/cache/shibboleth/metadata-internal.xml.8d0b
2026-05-15 14:12:37 DEBUG XMLTooling.util.CloneInputStream : initialized
2026-05-15 14:12:37 DEBUG XMLTooling.util.CloneInputStream : deleted
2026-05-15 14:12:37 INFO OpenSAML.MetadataProvider.XML : loaded XML
resource (https://example.com/realms/internal/protocol/saml/descriptor)
2026-05-15 14:12:37 DEBUG XMLTooling.Signature : unmarshalling ds:Signature
2026-05-15 14:12:37 INFO OpenSAML.MetadataProvider : applying metadata
filter (Signature)
2026-05-15 14:12:37 DEBUG XMLTooling.CredentialCriteria : credential
name(s) didn't overlap
2026-05-15 14:12:37 WARN OpenSAML.MetadataFilter.Signature : filtering out
entity at root of instance after failed signature check: CredentialResolver
did not supply any candidate keys.
2026-05-15 14:12:37 WARN OpenSAML.MetadataFilter.Signature : filtering out
entity at root of instance after failed signature check: CredentialResolver
did not supply any candidate keys.
2026-05-15 14:12:37 WARN OpenSAML.MetadataProvider.XML : adjusted reload
interval to 600 seconds
2026-05-15 14:12:37 WARN OpenSAML.MetadataProvider.XML : adjusted reload
interval to 600 seconds
2026-05-15 14:12:37 WARN OpenSAML.MetadataProvider.XML : trying backup
file, exception loading remote resource: SignatureMetadataFilter unable to
verify signature at root of metadata instance.
2026-05-15 14:12:37 WARN OpenSAML.MetadataProvider.XML : trying backup
file, exception loading remote resource: SignatureMetadataFilter unable to
verify signature at root of metadata instance.
2026-05-15 14:12:37 INFO OpenSAML.MetadataProvider.XML : using local backup
of remote resource
2026-05-15 14:12:37 ERROR XMLTooling.ParserPool : fatal error on line 0,
column 0, message: unable to open primary document entity
'/var/cache/shibboleth/metadata-internal.xml'
2026-05-15 14:12:37 ERROR XMLTooling.ParserPool : fatal error on line 0,
column 0, message: unable to open primary document entity
'/var/cache/shibboleth/metadata-internal.xml'
2026-05-15 14:12:37 ERROR OpenSAML.MetadataProvider.XML : error while
loading resource (/var/cache/shibboleth/metadata-internal.xml): XML
error(s) during parsing, check log for specifics
2026-05-15 14:12:37 ERROR OpenSAML.MetadataProvider.XML : error while
loading resource (/var/cache/shibboleth/metadata-internal.xml): XML
error(s) during parsing, check log for specifics
2026-05-15 14:12:37 CRIT OpenSAML.MetadataProvider.Chaining : failure
initializing MetadataProvider: XML error(s) during parsing, check log for
specifics
2026-05-15 14:12:37 CRIT OpenSAML.MetadataProvider.Chaining : failure
initializing MetadataProvider: XML error(s) during parsing, check log for
specifics
2026-05-15 14:12:37 DEBUG OpenSAML.MetadataProvider.XML : reload thread
started...running every 600 seconds

Den fre 15 maj 2026 kl 12:11 skrev Rod Widdowson <rdw at steadingsoftware.com>:

> > The problem I see is that Keycloak's Java XML signature library uses
> dsig: as the namespace
> > prefix (<dsig:Signature xmlns:dsig="http://www.w3.org/2000/09/xmldsig">),
> All other IdPs
> >  have worked with use ds: as the namespace prefix.
>
> This seems infeasible, but stranger things have happened.  What do the
> logs say?
>
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260515/280c3d8a/attachment.htm>