<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
SOLUTION (for my use case):<br>
<br>
I have found that the JAVA_OPTS option was not applied to the
Tomcat7 environment because I have not set up it on the
/etc/default/tomcat7 file.<br>
<br>
So, I have applied this JAVA_OPTS string to that file without any
other changes:<br>
<br>
JAVA_OPTS="-Djava.awt.headless=true -XX:+DisableExplicitGC
-XX:+UseParallelOldGC -Xms256m -Xmx2g -XX:MaxPermSize=512m"<br>
<br>
and it works!!!!<br>
<br>
At the end I had not need to change the opensaml library and its
dependencies, but only change the JAVA_OPTS for Tomcat7.<br>
<br>
I hope that this solution could be useful to other peoples.<br>
<br>
Thank you for all your help!!!<br>
Marco<br>
<br>
<br>
<div class="moz-cite-prefix">Il 11/08/14 15:28, Marco Malavolti ha
scritto:<br>
</div>
<blockquote cite="mid:53E8C4E1.5020505@garr.it" type="cite">Hi to
all, I hope you are fine. :)
<br>
<br>
Today I have a problem with the MetadataProvider (type:
metadata:FileBackedHTTPMetadataProvider) of my IDP.
<br>
<br>
I work with VM that has:
<br>
- Ubuntu 12.04.4 LTS
<br>
- Tomcat 7.0.26-1ubuntu
<br>
- Shibboleth IdP 2.4.0 installed
<br>
- I have updated my openSAML jar to the version 2.6.1 because I
have followed the advice found on this thread:
<br>
<a class="moz-txt-link-freetext" href="https://issues.shibboleth.net/jira/browse/JOST-220">https://issues.shibboleth.net/jira/browse/JOST-220</a>
<br>
<br>
This is my MetadataProvider configuration:
<br>
<br>
<!-- Metadata Refresh Period
<br>
minRefreshDelay == every 1 minutes
<br>
maxRefreshDelay == every 3 minutes -->
<br>
<br>
<metadata:MetadataProvider id="URLMD-Federation"
<br>
xsi:type="metadata:FileBackedHTTPMetadataProvider"
<br>
minRefreshDelay="PT1M"
<br>
maxRefreshDelay="PT3M"
<br>
metadataURL=<a class="moz-txt-link-rfc2396E" href="http://www.example.it/metadata-sha256.xml">"http://www.example.it/metadata-sha256.xml"</a>
<br>
backingFile="/opt/shibboleth-idp/metadata/metadata-sha256.xml">
<br>
<br>
<metadata:MetadataFilter
xsi:type="metadata:ChainingFilter">
<br>
<metadata:MetadataFilter
xsi:type="metadata:RequiredValidUntil" maxValidityInterval="P5D"
/>
<br>
<metadata:MetadataFilter
xsi:type="metadata:SignatureValidation"
trustEngineRef="shibboleth.MetadataTrustEngine"
requireSignedMetadata="true" />
<br>
</metadata:MetadataFilter>
<br>
</metadata:MetadataProvider>
<br>
<br>
Into my environment the Federation's metadata are signed every day
and, in the same time, the EntitiesDescriptor acquires a new
validUntil value valid for the next 5 days.
<br>
<br>
Is it possible that with this configuration my IdP doesn't
retrieve the new metadata but says to me only:
<br>
<br>
Beginning refresh of metadata from
'<a class="moz-txt-link-freetext" href="http://www.example.it/metadata-sha256.xml">http://www.example.it/metadata-sha256.xml</a>'
<br>
12:51:59.446 - DEBUG
[org.opensaml.saml2.metadata.provider.HTTPMetadataProvider:249] -
Attempting to fetch metadata document from
'<a class="moz-txt-link-freetext" href="http://www.example.it/metadata-sha256.xml">http://www.example.it/metadata-sha256.xml</a>'
<br>
12:51:59.452 - DEBUG
[org.opensaml.saml2.metadata.provider.HTTPMetadataProvider:254] -
Metadata document from '<a class="moz-txt-link-freetext" href="http://www.example.it/metadata-sha256.xml">http://www.example.it/metadata-sha256.xml</a>'
has not changed since last retrieval
<br>
12:51:59.452 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider:257]
- Metadata from '<a class="moz-txt-link-freetext" href="http://www.example.it/metadata-sha256.xml">http://www.example.it/metadata-sha256.xml</a>' has
not changed since last refresh
<br>
12:51:59.452 - DEBUG
[org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider:327]
- Computing new expiration time for cached metadata from
'<a class="moz-txt-link-freetext" href="http://www.example.it/metadata-sha256.xml">http://www.example.it/metadata-sha256.xml</a>
<br>
12:51:59.453 - INFO
[org.opensaml.saml2.metadata.provider.AbstractReloadingMetadataProvider:276]
- Next refresh cycle for metadata provider
'<a class="moz-txt-link-freetext" href="http://www.example.it/metadata-sha256.xml">http://www.example.it/metadata-sha256.xml</a>' will occur on
'2014-08-11T10:54:14.447Z' ('2014-08-11T12:54:14.447+02:00' local
time)
<br>
<br>
when the backingFile metadata file is different or not exists?
<br>
<br>
I have switched off my firewall so that any ports are blocked.
<br>
I have tried to understand something on the "idp-process.log" into
DEBUG mode without success because any ERROR appears on it.
<br>
I have tried to understand something on Tomcat7 "catalina.out"
(without success because I haven't found any useful information to
resolve this problem)
<br>
I have tried to force the download of the remote source metadata
by changing something into the backingFile file. Nothing to do.
<br>
<br>
I have found that the unique way that I have to correctly retrieve
the remote metadata source file into its backingFile metadata is
restart the Tomcat7 container.
<br>
<br>
I have understood that the
"metadata:FileBackedHTTPMetadataProvider" works like its brother
"metadata:HTTPMetadataProvider", but I have not understood why the
local/backingFile metadatas isn't come updated when it is
different from the remote one.
<br>
<br>
Help me, please!
<br>
<br>
Best Regards,
<br>
Marco Malavolti
<br>
<br>
P.S.: Forgive me for my bad English. If you don't understand me I
can try to explain again in a better way I hope.
<br>
<br>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
</blockquote>
</body>
</html>