<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 8/6/18 12:47 PM, Cody Carmichael
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAL9ddzLY8AA5MuvbxmTMXbhqPXUwBCXnyL+aG_zEU15CxvpdLA@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<div dir="ltr">
<div>Here is my metadata provider, currently the only configured
provider:</div>
<div><br>
</div>
<div>
<blockquote class="gmail_quote"
style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;margin:0px
0px 0px 0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex"><MetadataProvider
id="LocalEntityMetadataCRC"
xsi:type="FilesystemMetadataProvider"</blockquote>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
metadataFile="/opt/shibboleth-idp/metadata/meta-cert2.xml"></blockquote>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex"><br>
</blockquote>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<MetadataFilter xsi:type="Predicate"
direction="include"
removeEmptyEntitiesDescriptors="true"></blockquote>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<Entity><a
href="https://mySP/rest/v2/sso/message/shibboleth/metadata"
moz-do-not-send="true">https://mySP/rest/v2/sso/message/shibboleth/metadata</a></Entity></blockquote>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
</MetadataFilter> </blockquote>
</blockquote>
<blockquote class="gmail_quote"
style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;margin:0px
0px 0px 0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex">
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex"></MetadataProvider></blockquote>
</blockquote>
<br>
</div>
<div>
<div><br>
</div>
</div>
</div>
</blockquote>
<br>
As Tom already pointed out, if that's literally what you have, then
that's the problem. You're filtering out the EntityDescriptor that
you want, and so the log message is accurate that the backing store
doesn't contain it.<br>
<br>
Even if not, the message still means what it means, and there is
therefore something wrong with your metadata or config or similar.<br>
<br>
<blockquote type="cite"
cite="mid:CAL9ddzLY8AA5MuvbxmTMXbhqPXUwBCXnyL+aG_zEU15CxvpdLA@mail.gmail.com">
<div dir="ltr">
<div>
<div>The metadata contains the following: </div>
</div>
<div class="gmail-m_4787229116508880199gmail_signature">
<div dir="ltr"><span
style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">entityID="<a
href="https://mySP.net/" moz-do-not-send="true">https://mySP.net/</a><wbr>rest/v2/sso/message/<wbr>shibboleth/metadata"</span><br
style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial">
<span
style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">ID="_<wbr>ef844bd930b2aed9154854a0cb80ae<wbr>78"</span><br>
</div>
<div dir="ltr"><br>
</div>
<div><span
style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">When
I try to access the IdP's login page, the logs say:</span></div>
<div><span
style="font-size:small;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br>
</span></div>
<div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left:1px solid
rgb(204,204,204);padding-left:1ex"><span
style="background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">Metadata
Resolver FilesystemMetadataResolver
LocalEntityMetadataCRC: Metadata backing store does not
contain any EntityDescriptors with the ID: <a
href="https://mySP.net/rest/v2/sso/message/shibboleth/metadata"
moz-do-not-send="true">https://mySP.net/rest/v2/sso/message/shibboleth/metadata</a></span></blockquote>
<div><br>
</div>
<div>Which I understand it appears to be looking at the ID
instead of the entityID.</div>
</div>
</div>
</div>
</blockquote>
<br>
No, you're interpreting that too literally. Metadata lookup (at
least in all the basic and common cases) is by entityID.
Additionally, the ID attrib in metadata is usually a transient
value, generated and assigned anew on each new document "version",
and as such there is no way that it could be used as the basis for
looking it up by another party, since there's practically speaking
no way they would or could know it in advance.<br>
<br>
If you want to file a Jira issue, we can adjust the log output
there. But most people familiar with how this stuff works would
never confuse the 2 concepts, as ID simply can't be used that way.
Perhaps that explains why AFAIK noone has commented on it before.<br>
<br>
Thanks,<br>
Brent<br>
<br>
<br>
</body>
</html>