<div dir="ltr">Picture didn't seem to show for the Service Provider example so here it is (again?):<br><img alt="Inline image 1" src="cid:ii_143bc83d62b9689b"><br></div><div class="gmail_extra"><br clear="all"><div><font face="tahoma, sans-serif"><div>
<font face="tahoma, sans-serif"><br></font></div>Joshua Riffle</font><div><font face="tahoma, sans-serif">Software Engineer<br></font><div><font color="#CC0000" face="tahoma, sans-serif"><b>Azusa Pacific University</b></font></div>
</div></div>
<br><br><div class="gmail_quote">On Wed, Jan 22, 2014 at 4:31 PM, Joshua Riffle <span dir="ltr"><<a href="mailto:jriffle@apu.edu" target="_blank">jriffle@apu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div>So I have been testing scenarios for applying configuration changes to an Identity Provider using the automatic configuration reloading (in service.xml) on relying-party.xml specifically. In my use-case I tried momentarily commenting out a vanilla Shibboleth Service Provider that I use for testing.<br>
<br></div>Before:<br><font size="1"><span style="font-family:courier new,monospace"><metadata:MetadataProvider id="SPNONPROD"<br>xsi:type="metadata:FileBackedHTTPMetadataProvider"<br>metadataURL="<a href="http://idp-dev-01.devel.apu.edu/spnonprod-metadata.xml" target="_blank">http://idp-dev-01.devel.apu.edu/spnonprod-metadata.xml</a>"<br>
backingFile="/opt/shibboleth/metadata/sp-url-metadata.xml"><br></metadata:MetadataProvider></span></font><br><br><br>After:<br><font size="1"><span style="font-family:courier new,monospace"><!--<br>
<metadata:MetadataProvider id="SPNONPROD"<br>
xsi:type="metadata:FileBackedHTTPMetadataProvider"<br>metadataURL="<a href="http://idp-dev-01.devel.apu.edu/spnonprod-metadata.xml" target="_blank">http://idp-dev-01.devel.apu.edu/spnonprod-metadata.xml</a>"<br>
backingFile="/opt/shibboleth/metadata/sp-url-metadata.xml"><br>
</metadata:MetadataProvider></span></font> --><br clear="all"><div><div><div><font face="tahoma, sans-serif"><div><font face="tahoma, sans-serif"><br></font><span style="font-family:arial,helvetica,sans-serif">No other changes.<br>
<br>Before the change and the automatic reload (15 minutes) it allows me to login and see attributes from the Service Provider vantage point. After the change and the next automatic reload the Service Provider says there's no configured Service Provider with the entity ID in the request (as expected!).<br>
<br></span></div><div><span style="font-family:arial,helvetica,sans-serif">But... when I try to uncomment it and allow it to be automatically added back through configuration reloading. It appears to reload relying-party.xml succ<font face="tahoma, sans-serif">essfully</font> and the backed file sp-url-metadata.xml is populated with the correct information<font face="tahoma, sans-serif">. However,</font> the Identity Provider and the Service Provider both error out when I try to use the Service Provider:<br>
<br></span></div><div><font face="tahoma, sans-serif"><span style="font-family:arial,helvetica,sans-serif">On the Service Provider (w<font face="tahoma, sans-serif">hen accessing the secure folder)</font>:</span><br></font></div>
<div><font face="tahoma, sans-serif"><img alt="" height="222" width="420"><br>
<br></font></div><div><font face="tahoma, sans-serif"><span style="font-family:arial,helvetica,sans-serif">On the Identity Provider (w<font face="tahoma, sans-serif">hen initiating the Service Provider)</font>:</span><br>
<font size="1"><span style="font-family:courier new,monospace">16:23:07.950 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:923] - Could not resolve a key encryption credential for peer entity: <a href="https://sp.devel.apu.edu/shibboleth" target="_blank">https://sp.devel.apu.edu/shibboleth</a><br>
16:23:07.951 - ERROR [edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler:289] - Unable to construct encrypter<br>org.opensaml.xml.security.SecurityException: Could not resolve key encryption credential<br>
at edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.getEncrypter(AbstractSAML2ProfileHandler.java:924) ~[shibboleth-identityprovider-2.3.6.jar:na]<br> at edu.internet2.middleware.shibboleth.idp.profile.saml2.AbstractSAML2ProfileHandler.buildResponse(AbstractSAML2ProfileHandler.java:286) ~[shibboleth-identityprovider-2.3.6.jar:na]<br>
at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.completeAuthenticationRequest(SSOProfileHandler.java:310) [shibboleth-identityprovider-2.3.6.jar:na]<br> at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:177) [shibboleth-identityprovider-2.3.6.jar:na]<br>
at edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler.processRequest(SSOProfileHandler.java:88) [shibboleth-identityprovider-2.3.6.jar:na]<br> at edu.internet2.middleware.shibboleth.common.profile.ProfileRequestDispatcherServlet.service(ProfileRequestDispatcherServlet.java:84) [shibboleth-common-1.3.5.jar:na]<br>
at javax.servlet.http.HttpServlet.service(HttpServlet.java:717) [servlet-api.jar:na<font face="tahoma, sans-serif">]</font><br></span></font></font></div><div><font face="tahoma, sans-serif"><font size="1"><span style="font-family:courier new,monospace">...elided...</span></font><br>
</font></div><div><font face="tahoma, sans-serif"><br></font></div><div><font face="tahoma, sans-serif"><span style="font-family:arial,helvetica,sans-serif">It "looks" like it's not fully reloading the Service Provider if (and only if) it is being added back again after existing previously. Is that expected behavior or am I missing something? I have tested a number of other surround scenarios and can elaborate if needed.</span><span class="HOEnZb"><font color="#888888"><br>
</font></span></font></div><span class="HOEnZb"><font color="#888888"><div><font face="tahoma, sans-serif"><br></font></div><div><font face="tahoma, sans-serif"><br></font></div>Joshua Riffle</font></span></font><span class="HOEnZb"><font color="#888888"><div>
<font face="tahoma, sans-serif">Software Engineer<br></font><div><font color="#CC0000" face="tahoma, sans-serif"><b>Azusa Pacific University</b></font></div>
</div></font></span></div>
</div></div></div>
</blockquote></div><br></div>