<div dir="ltr"><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div style="font-size:small">Our test IdP recently failed after a restart because one of our FileBackedHTTPMetadataProviders couldn't validate the certificate from the remote resource and had no existing backing file. The certificate was indeed invalid for that provider, but I'm surprised that this apparently caused the whole metadata resolver to fail to initialise.</div><div style="font-size:small"><br></div><div style="font-size:small">On startup, this was logged:</div><div style="font-size:small"><br></div><div style="font-size:small"><font face="monospace">ERROR [org.opensaml.saml.metadata.resolver.impl.HTTPMetadataResolver:238] [ ] - Metadata Resolver FileBackedHTTPMetadataResolver foobar: Error retrieving metadata from <a href="https://example.com/metadata">https://example.com/metadata</a>: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target<br>ERROR [org.opensaml.saml.metadata.resolver.impl.FileBackedHTTPMetadataResolver:317] [ ] - Metadata Resolver FileBackedHTTPMetadataResolver foobar: Unable to read metadata from remote server and backup does not exist<br>ERROR [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:377] [ ] - Metadata Resolver FileBackedHTTPMetadataResolver foobar: Error occurred while attempting to refresh metadata from '<a href="https://example.com/metadata">https://example.com/metadata</a>'<br>ERROR [org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:292] [ ] - Metadata Resolver FileBackedHTTPMetadataResolver foobar: Metadata provider failed to properly initialize, fail-fast=true, halting<br>ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:182] [ ] - Service 'shibboleth.MetadataResolverService': Initial load failed<br>net.shibboleth.utilities.java.support.service.ServiceException: Failed to load [file [/opt/shibboleth-idp/conf/metadata-providers.xml], file [/opt/shibboleth-idp/system/conf/metadata-providers-system.xml]]<br>        at net.shibboleth.ext.spring.service.ReloadableSpringService.doReload(ReloadableSpringService.java:387)<br>Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'ShibbolethMetadata': Cannot create inner bean '(inner bean)#1a958d2a' of type [org.opensaml.saml.metadata.resolver.ChainingMetadataResolver] while setting bean property 'embeddedResolver'; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#1a958d2a': Cannot create inner bean '(inner bean)#39a9b3ee' of type [org.opensaml.saml.metadata.resolver.impl.FileBackedHTTPMetadataResolver] while setting bean property 'resolvers' with key [68]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#39a9b3ee': Invocation of init method failed; nested exception is net.shibboleth.utilities.java.support.component.ComponentInitializationException: Error refreshing metadata during init<br>        at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBean(BeanDefinitionValueResolver.java:389)<br>Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#1a958d2a': Cannot create inner bean '(inner bean)#39a9b3ee' of type [org.opensaml.saml.metadata.resolver.impl.FileBackedHTTPMetadataResolver] while setting bean property 'resolvers' with key [68]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#39a9b3ee': Invocation of init method failed; nested exception is net.shibboleth.utilities.java.support.component.ComponentInitializationException: Error refreshing metadata during init<br>        at org.springframework.beans.factory.support.BeanDefinitionValueResolver.resolveInnerBean(BeanDefinitionValueResolver.java:389)<br>Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name '(inner bean)#39a9b3ee': Invocation of init method failed; nested exception is net.shibboleth.utilities.java.support.component.ComponentInitializationException: Error refreshing metadata during init<br>        at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1796)<br>Caused by: net.shibboleth.utilities.java.support.component.ComponentInitializationException: Error refreshing metadata during init<br>        at org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver.initMetadataResolver(AbstractReloadingMetadataResolver.java:327)<br>Caused by: net.shibboleth.utilities.java.support.resolver.ResolverException: Exception during refresh<br>        at org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver.refresh(AbstractReloadingMetadataResolver.java:378)<br>Caused by: net.shibboleth.utilities.java.support.resolver.ResolverException: Unable to read metadata from remote server and backup does not exist<br>        at org.opensaml.saml.metadata.resolver.impl.FileBackedHTTPMetadataResolver.fetchMetadata(FileBackedHTTPMetadataResolver.java:318)<br>ERROR [net.shibboleth.utilities.java.support.service.AbstractReloadableService:185] [ ] - Service 'shibboleth.MetadataResolverService': No further attempts will be made to reload</font><br></div><div style="font-size:small"><br></div>Then subsequently, when trying to authenticate to an unrelated SP:<div style="font-size:small"><font face="monospace"><br></font></div><div style="font-size:small">ERROR [net.shibboleth.idp.saml.metadata.impl.ReloadingRelyingPartyMetadataProvider:71] [7E86F835FB677456435CDA2F258FF641 10.255.0.1] - RelyingPartyMetadataProvider 'shibboleth.MetadataResolver': Error accessing underlying metadata source: Invalid configuration.<font face="monospace"><br></font></div><div style="font-size:small"><font face="monospace"><br></font></div>Removing the one failing MetadataProvider and reloading the metadata resolver service got things going again.</div><div dir="ltr"><br></div><div dir="ltr">To my knowledge, we have not enabled failFast on the metadata service, or on any other service. In services.properties, all the failFast values are unspecified (eg <div style="font-size:small"><font face="monospace">#idp.service.metadata.failFast = false</font> and <font face="monospace">#idp.service.failFast = false</font>).<font face="monospace"><br></font></div><div style="font-size:small"><br></div><div style="font-size:small">Is there any way to avoid this sort of situation?</div><div style="font-size:small"><br></div><div style="font-size:small">Thanks,</div><div style="font-size:small"><br></div><div style="font-size:small">Max Spicer</div><div style="font-size:small"><br></div><div style="font-size:small"><br></div></div></div></div></div></div></div>