<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
Hello,</div>
<div class="elementToProof" style="font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
Shibboleth 5.1.2</div>
<div class="elementToProof" style="font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
Tomcat 10.1.26.0</div>
<div class="elementToProof" style="font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
RHEL 8</div>
<div class="elementToProof" style="font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
On our Shibboleth service, we found that intermittently any requests to our Shibboleth service would be fully blocked for about 60 seconds, resulting in connection timeouts. Thread dumps indicate that all request threads were BLOCKED on an org.opensaml.saml.metadata.resolver.impl.FileBackedHTTPMetadataResolver
object. Browsing the logs, we determined that, one of our SP MetadataProviders of type FileBackedHTTPMetadataResolver encountered a connect timeout:</div>
<blockquote style="margin-left: 0.8ex; padding-left: 1ex; border-left: 3px solid rgb(200, 200, 200);">
<div class="elementToProof" style="font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
Error retrieving metadata from https://[REDACTED]/metadata.php: Connect to https://[REDACTED]:443 [[REDACTED]] failed: Connect timed out</div>
</blockquote>
<div class="elementToProof" style="font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
My concern is that all other requests were blocked for 60 seconds while the shibboleth service attempted to load the metadata for this SP. However, it seems unwise that an issue retrieving metadata can cause the entire application to be blocked for 60 seconds.
Is anyone aware of how to avoid this issue?</div>
<div class="elementToProof" style="font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
If it matters, the metadata for this SP is configured within a ChainingMetadataProvider:</div>
<blockquote style="margin-left: 0.8ex; padding-left: 1ex; border-left: 3px solid rgb(200, 200, 200);">
<div class="elementToProof" style="font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
<MetadataProvider id="ShibbolethMetadata" xsi:type="ChainingMetadataProvider"</div>
<div class="elementToProof" style="font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
...</div>
<div class="elementToProof" style="font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
<MetadataProvider id="[REDACTED]"</div>
<div style="font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
xsi:type="FileBackedHTTPMetadataProvider"</div>
<div class="elementToProof" style="font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
backingFile="%{idp.home}/metadata/[REDACTED].xml"</div>
<div class="elementToProof" style="font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
metadataURL="https://[REDACTED]/metadata.php" </div>
<div class="elementToProof" style="font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
/></div>
<div class="elementToProof" style="font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
...</div>
<div class="elementToProof" style="font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
</MetadataProvider></div>
</blockquote>
<div class="elementToProof" style="font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
Thanks,</div>
<div class="elementToProof" style="font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
Jory</div>
<div id="Signature" class="elementToProof" data-lt-sig-active="" style="color: inherit;">
<div style="font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="background-color: rgb(255, 255, 255);">
<div style="direction: ltr; font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
---</div>
<div style="direction: ltr; font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
Jory Osterptak (he/him/his)</div>
<div style="direction: ltr; font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
Senior Systems Engineer</div>
<div style="direction: ltr; font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
University IT</div>
<div style="direction: ltr; font-family: Consolas, Courier, monospace; font-size: 10pt; color: rgb(0, 0, 0);">
University of Rochester</div>
</div>
</div>
</body>
</html>