<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">I’ve started my new Idp install again based on the 3.1 release from earlier this week. Attribute-resolver and –filter.xml have been copied in from our old (2.3.8) IdP, and there are no complaints in the logs (hurrah).<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">However, when I’m trying to specify the file-backed metadata for the UK federation, I get this error:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2015-03-13 11:42:20,358 - ERROR [org.springframework.web.context.ContextLoader:331] - Context initialization failed<o:p></o:p></p>
<p class="MsoNormal">org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'shibboleth.MetadataResolverService' defined in file [/opt/shibboleth-idp/system/conf/services-system.xml]: Invocation of init method failed; nested
exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'ShibbolethMetadata': Cannot create inner bean '(inner bean)#51dba25c' of type [org.opensaml.saml.metadata.resolver.ChainingMetadataResolver] while setting
constructor argument; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#51dba25c': Cannot create inner bean '(inner bean)#7bd00986' of type [org.opensaml.saml.metadata.resolver.impl.FileBackedHTTPMetadataResolver]
while setting bean property 'resolvers' with key [0]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#7bd00986': Invocation of init method failed; nested exception is net.shibboleth.utilities.java.support.component.ComponentInitializationException:
Error refreshing metadata during init<o:p></o:p></p>
<p class="MsoNormal"> at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1566)<o:p></o:p></p>
<p class="MsoNormal">Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'ShibbolethMetadata': Cannot create inner bean '(inner bean)#51dba25c' of type [org.opensaml.saml.metadata.resolver.ChainingMetadataResolver]
while setting constructor argument; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#51dba25c': Cannot create inner bean '(inner bean)#7bd00986' of type [org.opensaml.saml.metadata.resolver.impl.FileBackedHTTPMetadataResolver]
while setting bean property 'resolvers' with key [0]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#7bd00986': Invocation of init method failed; nested exception is net.shibboleth.utilities.java.support.component.ComponentInitializationException:
Error refreshing metadata during init<o:p></o:p></p>
<p class="MsoNormal"> at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBean(BeanDefinitionValueResolver.java:313)<o:p></o:p></p>
<p class="MsoNormal">Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#51dba25c': Cannot create inner bean '(inner bean)#7bd00986' of type [org.opensaml.saml.metadata.resolver.impl.FileBackedHTTPMetadataResolver]
while setting bean property 'resolvers' with key [0]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#7bd00986': Invocation of init method failed; nested exception is net.shibboleth.utilities.java.support.component.ComponentInitializationException:
Error refreshing metadata during init<o:p></o:p></p>
<p class="MsoNormal"> at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBean(BeanDefinitionValueResolver.java:313)<o:p></o:p></p>
<p class="MsoNormal">Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#7bd00986': Invocation of init method failed; nested exception is net.shibboleth.utilities.java.support.component.ComponentInitializationException:
Error refreshing metadata during init<o:p></o:p></p>
<p class="MsoNormal"> at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1566)<o:p></o:p></p>
<p class="MsoNormal">Caused by: net.shibboleth.utilities.java.support.component.ComponentInitializationException: Error refreshing metadata during init<o:p></o:p></p>
<p class="MsoNormal"> at org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver.initMetadataResolver(AbstractReloadingMetadataResolver.java:264)<o:p></o:p></p>
<p class="MsoNormal">Caused by: net.shibboleth.utilities.java.support.resolver.ResolverException: net.shibboleth.utilities.java.support.resolver.ResolverException: Error filtering metadata from http://metadata.ukfederation.org.uk/ukfederation-metadata.xml<o:p></o:p></p>
<p class="MsoNormal"> at org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver.refresh(AbstractReloadingMetadataResolver.java:297)<o:p></o:p></p>
<p class="MsoNormal">Caused by: net.shibboleth.utilities.java.support.resolver.ResolverException: Error filtering metadata from http://metadata.ukfederation.org.uk/ukfederation-metadata.xml<o:p></o:p></p>
<p class="MsoNormal"> at org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver.processNonExpiredMetadata(AbstractReloadingMetadataResolver.java:430)<o:p></o:p></p>
<p class="MsoNormal">Caused by: org.opensaml.saml.metadata.resolver.filter.FilterException: Metadata's validity interval, 1753369669ms, is larger than is allowed, 604800ms.<o:p></o:p></p>
<p class="MsoNormal"> at org.opensaml.saml.metadata.resolver.filter.impl.RequiredValidUntilFilter.filter(RequiredValidUntilFilter.java:102)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The metadata-providers entry is based on the wiki example, but I turned off the signing (which someone may tell me is wrong here):<o:p></o:p></p>
<p class="MsoNormal"><?xml version="1.0" encoding="UTF-8"?><o:p></o:p></p>
<p class="MsoNormal"><!-- This file is an EXAMPLE metadata configuration file. --><o:p></o:p></p>
<p class="MsoNormal"><MetadataProvider id="ShibbolethMetadata" xsi:type="ChainingMetadataProvider"<o:p></o:p></p>
<p class="MsoNormal"> xmlns="urn:mace:shibboleth:2.0:metadata"<o:p></o:p></p>
<p class="MsoNormal"> xmlns:resource="urn:mace:shibboleth:2.0:resource"<o:p></o:p></p>
<p class="MsoNormal"> xmlns:security="urn:mace:shibboleth:2.0:security"<o:p></o:p></p>
<p class="MsoNormal"> xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"<o:p></o:p></p>
<p class="MsoNormal"> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"<o:p></o:p></p>
<p class="MsoNormal"> xsi:schemaLocation="urn:mace:shibboleth:2.0:metadata http://shibboleth.net/schema/idp/shibboleth-metadata.xsd<o:p></o:p></p>
<p class="MsoNormal"> urn:mace:shibboleth:2.0:resource http://shibboleth.net/schema/idp/shibboleth-resource.xsd
<o:p></o:p></p>
<p class="MsoNormal"> urn:mace:shibboleth:2.0:security http://shibboleth.net/schema/idp/shibboleth-security.xsd<o:p></o:p></p>
<p class="MsoNormal"> urn:oasis:names:tc:SAML:2.0:metadata http://docs.oasis-open.org/security/saml/v2.0/saml-schema-metadata-2.0.xsd"><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <!-- ========================================================================================== --><o:p></o:p></p>
<p class="MsoNormal"> <!-- Metadata Configuration --><o:p></o:p></p>
<p class="MsoNormal"> <!-- --><o:p></o:p></p>
<p class="MsoNormal"> <!-- Below you place the mechanisms which define how to load the metadata for the SP you will --><o:p></o:p></p>
<p class="MsoNormal"> <!-- provide a service to. --><o:p></o:p></p>
<p class="MsoNormal"> <!-- --><o:p></o:p></p>
<p class="MsoNormal"> <!-- Two examples are provided. The Shibboleth Documentation at --><o:p></o:p></p>
<p class="MsoNormal"> <!-- https://wiki.shibboleth.net/confluence/display/IDP30/MetadataConfiguration --><o:p></o:p></p>
<p class="MsoNormal"> <!-- provides more details. -->
<o:p></o:p></p>
<p class="MsoNormal"> <!-- --><o:p></o:p></p>
<p class="MsoNormal"> <!-- NOTE. This file SHOULD NOT contain the metadata for this IdP. --><o:p></o:p></p>
<p class="MsoNormal"> <!-- --><o:p></o:p></p>
<p class="MsoNormal"> <!-- ========================================================================================== --><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <!-- Load the UK metadata --><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <MetadataProvider id="URLMD" xsi:type="FileBackedHTTPMetadataProvider"<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> xmlns="urn:mace:shibboleth:2.0:metadata"<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> metadataURL="http://metadata.ukfederation.org.uk/ukfederation-metadata.xml"<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> backingFile="/opt/shibboleth-idp/metadata/ukfederation-metadata.xml"><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <!-- Using chaining filter to allow us multiple filters to be added --><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <MetadataFilter xsi:type="ChainingFilter" xmlns="urn:mace:shibboleth:2.0:metadata"><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <!-- Ensure the metadata has a reasonable (1 week) validity period. --><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <MetadataFilter xsi:type="RequiredValidUntil" xmlns="urn:mace:shibboleth:2.0:metadata"<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> maxValidityInterval="604800" /><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <!-- <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> Ensure metadata is signed and use the 'shibboleth.MetadataTrustEngine'
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> to determine its trustworthiness <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> --><o:p></o:p></p>
<p class="MsoNormal"><!--<o:p></o:p></p>
<p class="MsoNormal"> <MetadataFilter xsi:type="SignatureValidation" xmlns="urn:mace:shibboleth:2.0:metadata"<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> trustEngineRef="shibboleth.MetadataTrustEngine"<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> requireSignedMetadata="true" /><o:p></o:p></p>
<p class="MsoNormal">--><o:p></o:p></p>
<p class="MsoNormal"><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> </MetadataFilter><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> </MetadataProvider><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"></MetadataProvider><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks in advance for any pointers,<o:p></o:p></p>
<p class="MsoNormal">Dave<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-GB">_________________________________________________<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-GB">Dave Perry<br>
eLearning Technologist, Hull College Group<br>
<br>
Room L34 - Queens Gardens Library<br>
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG<br>
Extension 2230 / Direct Dial 01482 381930<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-GB">* Need a fast reply? Try
<a href="mailto:elearning@hull-college.ac.uk">elearning@hull-college.ac.uk</a> *<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-GB"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-GB">Rate our service with the Library & eLearning Survey<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-GB">For Students:
<a href="http://library.hull-college.ac.uk/survey">http://library.hull-college.ac.uk/survey</a>
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif";mso-fareast-language:EN-GB">For Staff:
<a href="http://library.hull-college.ac.uk/staffsurvey">http://library.hull-college.ac.uk/staffsurvey</a>
<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div><hr /></div><div><font color="#999999" size="2"><font face="Arial">This message is sent in confidence for the addressee </font><span style="font-family: Arial;">only. It may contain confidential or sensitive </span><span style="font-family: Arial;">information. The contents are not to be disclosed </span><span style="font-family: Arial;">to anyone other than the addressee. Unauthorised </span><span style="font-family: Arial;">recipients are requested to preserve this </span><span style="font-family: Arial;">confidentiality and to advise us of any errors in </span><span style="font-family: Arial;">transmission. Any views expressed in this message </span><span style="font-family: Arial;">are solely the views of the individual and do not </span><span style="font-family: Arial;">represent the views of the College. Nothing in this </span><span style="font-family: Arial;">message should be construed as creating a contract.</span></font></div><div><font face="Arial" color="#999999" size="2"><br /></font></div><div><font face="Arial" color="#999999" size="2">Hull College owns the email infrastructure, including the contents.</font></div><div><font face="Arial" color="#999999" size="2"><br /></font></div><div><font face="Arial" size="2" color="#00cc33">Hull College is committed to sustainability, please reflect before printing this email.</font></div><div><hr /></div>
</body>
</html>