<html><body><div style="color:#000; background-color:#fff; font-family:arial, helvetica, sans-serif;font-size:12pt"><div><span>Yes, the pem file is there. I do not use a backing file for this fed. I can hit the URL for the metadata from the server and get the data. I have touched the config and forced a reload. No errors logged. Same with shibd -check. No errors. The EntityID that you see in the config is for the federation, not the member. It's just very odd. The two servers are mirrored config and supporting file wise.</span></div><div><span></span></div><div><br></div> <div style="font-size: 12pt; font-family: arial, helvetica, sans-serif; "> <div style="font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "> <div dir="ltr"> <font size="2" face="Arial"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Nate Klingenstein <ndk@internet2.edu><br> <b><span
style="font-weight: bold;">To:</span></b> Shib Users <users@shibboleth.net> <br> <b><span style="font-weight: bold;">Sent:</span></b> Monday, November 12, 2012 9:53 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: unable to locate metadata<br> </font> </div> <br>
<div id="yiv64069029"><div>Mike,<div><br></div><div><div><div><blockquote type="cite"><div style="font-size: 16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; background-color: transparent; font-family: arial, helvetica, sans-serif; "><div style="background-color:transparent;"><font class="yiv64069029Apple-style-span" face="arial, helvetica, sans-serif"><span class="yiv64069029Apple-tab-span" style="white-space:pre;"> </span><MetadataProvider type="XML" uri="<a rel="nofollow" target="_blank" href="https://federation.belnet.be/federation-metadata.xml">https://federation.belnet.be/federation-metadata.xml</a>" ></font></div><div style="background-color:transparent;"><font class="yiv64069029Apple-style-span" face="arial, helvetica, sans-serif">
<MetadataFilter type="Signature" verifyName="false" certificate="<a target="_blank" href="http://certificate.federation.belnet.be.pe/">certificate.federation.belnet.be</a>.pem"/></font></div><div style="background-color:transparent;"><font class="yiv64069029Apple-style-span" face="arial, helvetica, sans-serif"> <MetadataFilter type="RequireValidUntil" maxValidityInterval="7776000"/></font></div><div style="background-color:transparent;"><font class="yiv64069029Apple-style-span" face="arial, helvetica, sans-serif"><span class="yiv64069029Apple-tab-span" style="white-space:pre;"> </span></MetadataProvider><span class="yiv64069029Apple-tab-span" style="white-space:pre;"> </span></font></div><div style="font-size: 16px; background-color: transparent; font-style: normal; font-family: arial, helvetica, sans-serif; "><br></div><div style="font-size: 16px; background-color: transparent; font-style:
normal; font-family: arial, helvetica, sans-serif; ">Shibd -check is happy. I can hit <span class="yiv64069029Apple-style-span" style="font-size:16px;"><a rel="nofollow" target="_blank" href="https://federation.belnet.be/federation-metadata.xml">https://federation.belnet.be/federation-metadata.xml</a><span class="yiv64069029Apple-converted-space"> </span>from the server in question. The config files for both machines are identical (I usually do the mods to 1 server and copy Shibboleth2.xml and any dependent files to the other server. When a BellNet customer hits my primary server, everything is fine. If they hit my secondary server they get a 500</span></div></div></blockquote><div><br></div><div>This is the expected error condition when there is no metadata found.</div><br><blockquote type="cite"><div style="font-size: 16px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal;
line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; background-color: transparent; font-family: arial, helvetica, sans-serif; "><div style="font-size: 16px; background-color: transparent; font-style: normal; font-family: arial, helvetica, sans-serif; "><span class="yiv64069029Apple-style-span" style="font-size:16px;">and the logs show this:</span></div><div style="font-size: 16px; background-color: transparent; font-style: normal; font-family: arial, helvetica, sans-serif; "><span class="yiv64069029Apple-style-span" style="font-size:16px;"><br></span></div><div style="background-color:transparent;"><font class="yiv64069029Apple-style-span" face="arial, helvetica, sans-serif">2012-11-12 06:40:23 WARN Shibboleth.SessionInitiator.SAML2 [66]: unable to locate metadata for provider (urn:mace:kuleuven.be:kulassoc:wenk.be)</font><br></div><div style="font-size: 16px; background-color:
transparent; font-style: normal; font-family: 'Times New Roman'; "><font class="yiv64069029Apple-style-span" face="arial, helvetica, sans-serif"><br></font></div><div style="font-size: 16px; background-color: transparent; font-style: normal; font-family: arial, helvetica, sans-serif; "><font class="yiv64069029Apple-style-span" face="arial, helvetica,
sans-serif">Can anyone offer a clue for me here on this? All other feds on the secondary server are working fine. Just this one fails.</font></div></div></blockquote></div><br></div></div><div>A couple obvious checks: is the metadata file in /var/run/shibboleth/? Is the signing certificate in place? Is this the right entityID and is it present in the metadata file? (it doesn't match the SessionInitiator)</div><div><br></div><div>You'll also get more descriptive logging messages during startup. Try touching /etc/shibboleth/shibboleth2.xml and checking the logs for anything more helpful.</div><div><br></div><div>Take care,</div><div>Nate.</div></div></div><br>--<br>To unsubscribe from this list send an email to <a ymailto="mailto:users-unsubscribe@shibboleth.net" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br><br> </div> </div> </div></body></html>