<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Check your IdP metadata provider setting for InCommon metadata. If it is configured to use the InCommon aggregate instead of using the MDQ protocol, then check if you have set a RequiredValidUntil metadata
filter. If the maxValidityInterval is set to 14 days (P14D or some other time unit equivalent), you’ll want to temporarily increase that to 21 days. This is because recently the InCommon aggregate was published with a validUntil date 3 weeks in the future,
instead of 2 weeks.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">You can also confirm that this is the issue if you see messages like this in your idp-process.log:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">ERROR [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:376] - Metadata Resolver FileBackedHTTPMetadataResolver incommonaggregate: Error occurred while attempting to refresh metadata
from 'https://mdq.incommon.org/entities'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">net.shibboleth.utilities.java.support.resolver.ResolverException: Error filtering metadata from
<a href="https://mdq.incommon.org/entities">https://mdq.incommon.org/entities</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver.processNonExpiredMetadata(AbstractReloadingMetadataResolver.java:552)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Caused by: org.opensaml.saml.metadata.resolver.filter.FilterException: Metadata's validity interval PT502H50M7.901S is larger than is allowed PT336H<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> at org.opensaml.saml.metadata.resolver.filter.impl.RequiredValidUntilFilter.filter(RequiredValidUntilFilter.java:97)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">HTH,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Marcus Mizushima<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Identity Management Analyst<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">California State University, Office of the Chancellor<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users <users-bounces@shibboleth.net>
<b>On Behalf Of </b>Mittel, Don via users<br>
<b>Sent:</b> Monday, February 17, 2025 4:46 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Cc:</b> Mittel, Don <dmittel@depaul.edu><br>
<b>Subject:</b> Shibboleth stopped working<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="mso-line-height-alt:.75pt"><span style="font-size:1.0pt;color:white">Shibboleth was working find until earlier today when all of the sudden my servers started reporting errors like this: 2025-02-17 17:</span><span style="font-size:1.0pt;font-family:"Arial",sans-serif;color:white"> </span><span style="font-size:1.0pt;color:white">41:</span><span style="font-size:1.0pt;font-family:"Arial",sans-serif;color:white"> </span><span style="font-size:1.0pt;color:white">02,722
- WARN [org.</span><span style="font-size:1.0pt;font-family:"Arial",sans-serif;color:white"> </span><span style="font-size:1.0pt;color:white">opensaml.</span><span style="font-size:1.0pt;font-family:"Arial",sans-serif;color:white"> </span><span style="font-size:1.0pt;color:white">saml.</span><span style="font-size:1.0pt;font-family:"Arial",sans-serif;color:white"> </span><span style="font-size:1.0pt;color:white">metadata.</span><span style="font-size:1.0pt;font-family:"Arial",sans-serif;color:white"> </span><span style="font-size:1.0pt;color:white">resolver.</span><span style="font-size:1.0pt;font-family:"Arial",sans-serif;color:white"> </span><span style="font-size:1.0pt;color:white">impl.</span><span style="font-size:1.0pt;font-family:"Arial",sans-serif;color:white"> </span><span style="font-size:1.0pt;color:white">AbstractMetadataResolver:</span><span style="font-size:1.0pt;font-family:"Arial",sans-serif;color:white"> </span><span style="font-size:1.0pt;color:white">551]
- FileBackedHTTPMetadataResolver<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-line-height-alt:.75pt"><span style="font-size:1.0pt;color:white"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">Shibboleth was working find until earlier today when all of the sudden my servers started reporting errors like this:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">2025-02-17 17:41:02,722 - WARN [org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:551] - FileBackedHTTPMetadataResolver ICMD: Metadata backing store contained an EntityDescriptor with the ID:
<a href="https://urldefense.com/v3/__https:/depaul-sa.terradotta.com/sp/shibboleth__;!!MWueTNF2!UUWjYdTqkZ5l9Gc_3GYfmI0NBtK-wROLfe6f9OnvwawRS4PdvekAuHWx6WIpIoYoipQpSI6YokaWXJWwpf9dUdE$">
https://depaul-sa.terradotta.com/sp/shibboleth</a>, but it was no longer valid<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">2025-02-17 17:41:02,722 - INFO [org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler:185] - Message Handler: No metadata returned for
<a href="https://urldefense.com/v3/__https:/depaul-sa.terradotta.com/sp/shibboleth__;!!MWueTNF2!UUWjYdTqkZ5l9Gc_3GYfmI0NBtK-wROLfe6f9OnvwawRS4PdvekAuHWx6WIpIoYoipQpSI6YokaWXJWwpf9dUdE$">
https://depaul-sa.terradotta.com/sp/shibboleth</a> in role {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor with protocol urn:oasis:names:tc:SAML:2.0:protocol<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">2025-02-17 17:41:02,722 - WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:164] - Profile Action SelectProfileConfiguration: Profile
<a href="https://urldefense.com/v3/__http:/shibboleth.net/ns/profiles/saml2/sso/browser__;!!MWueTNF2!UUWjYdTqkZ5l9Gc_3GYfmI0NBtK-wROLfe6f9OnvwawRS4PdvekAuHWx6WIpIoYoipQpSI6YokaWXJWwiOKxibM$">
http://shibboleth.net/ns/profiles/saml2/sso/browser</a> is not available for RP configuration shibboleth.UnverifiedRelyingParty (RPID
<a href="https://urldefense.com/v3/__https:/depaul-sa.terradotta.com/sp/shibboleth__;!!MWueTNF2!UUWjYdTqkZ5l9Gc_3GYfmI0NBtK-wROLfe6f9OnvwawRS4PdvekAuHWx6WIpIoYoipQpSI6YokaWXJWwpf9dUdE$">
https://depaul-sa.terradotta.com/sp/shibboleth</a>)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">2025-02-17 17:41:02,722 - WARN [org.opensaml.profile.action.impl.LogEvent:94] - A non-proceed event occurred while processing the request: InvalidProfileConfiguration
<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">Now any time we try to access a relying party we get this error:<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="color:black">Unsupported Request</span></b><span style="color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">The application you have accessed is not registered for use with this service.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
</div>
</body>
</html>