<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
p.xmsonormal, li.xmsonormal, div.xmsonormal
{mso-style-name:x_msonormal;
margin:0in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
span.EmailStyle25
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">FWIW: If you’re using MDQ the metadata returned by that protocol does have the validUntil set for 2 weeks as expected.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Mittel, Don <dmittel@depaul.edu>
<br>
<b>Sent:</b> Monday, February 17, 2025 5:15 PM<br>
<b>To:</b> Mizushima, Marcus <mmizushima@calstate.edu>; Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: [EXT] RE: Shibboleth stopped working<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="mso-line-height-alt:.75pt"><span style="font-size:1.0pt;color:white">I had not yet switched to the MDQ protocol yet, i was just reading about that. We are still using the old method for the metadata, but changing the maxValidityInterval
from 14 to 21 has resolved our issue. Thank you. Going to look into switching<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="mso-line-height-alt:.75pt"><span style="font-size:1.0pt;color:white"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">I had not yet switched to the MDQ protocol yet, i was just reading about that. We are still using the old method for the metadata, but changing the maxValidityInterval from 14 to 21 has resolved our issue. Thank
you.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="color:black">Going to look into switching over to the MDQ and will make sure to set it for 21 days.<o:p></o:p></span></p>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="divRplyFwdMsg">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"> Mizushima, Marcus <<a href="mailto:mmizushima@calstate.edu">mmizushima@calstate.edu</a>><br>
<b>Sent:</b> Monday, February 17, 2025 7:07 PM<br>
<b>To:</b> Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<b>Cc:</b> Mittel, Don <<a href="mailto:dmittel@depaul.edu">dmittel@depaul.edu</a>><br>
<b>Subject:</b> [EXT] RE: Shibboleth stopped working</span> <o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
<div>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" align="left" width="100%" style="width:100.0%">
<tbody>
<tr>
<td style="background:#A6A6A6;padding:0in 0in 0in 0in"></td>
<td width="100%" style="width:100.0%;background:#EAEAEA;padding:0in 0in 0in 0in;background:revert!important;border:revert!important;bottom:revert!important;color:revert!important;direction:revert!important;display:revert!important;font-size:revert!important;height:revert!important;letter-spacing:revert!important;line-height:revert!important;margin:revert!important;opacity:revert!important;order:revert!important;outline:revert!important;overflow:revert!important;padding:revert!important;position:revert!important;tab-size:revert!important;table-layout:revert!important;text-align:revert!important;text-indent:revert!important;text-orientation:revert!important;text-overflow:revert!important;text-transform:revert!important;top:revert!important;vertical-align:revert!important;visibility:revert!important;white-space:revert!important;width:revert!important;word-break:revert!important;word-spacing:revert!important;writing-mode:revert!important;zoom:revert!important;width:100%!important;background-color:#EAEAEA!important;padding:15px!important;font-size:12px!important;font-weight:normal!important;color:#212121!important;text-align:left!important;word-wrap:break-word!important">
<div>
<p class="MsoNormal" style="mso-element:frame;mso-element-frame-hspace:2.25pt;mso-element-wrap:around;mso-element-anchor-vertical:paragraph;mso-element-anchor-horizontal:column;mso-height-rule:exactly">
<span style="font-family:"Segoe UI",sans-serif;color:black">You don't often get email from
<a href="mailto:mmizushima@calstate.edu">mmizushima@calstate.edu</a>. <a href="https://urldefense.com/v3/__https:/aka.ms/LearnAboutSenderIdentification__;!!MWueTNF2!Q8hDmktJ0wscZHLdJyKTLZBQP5XKDLH4UrdXaeuLlqrUR5Pc6xn7C7yzZU3fMdmn0kk746YMwVFP_-cpia-Rgpmm$">
Learn why this is important</a> </span><span style="font-family:"Segoe UI",sans-serif"><o:p></o:p></span></p>
</div>
</td>
<td style="background:#EAEAEA;padding:0in 0in 0in 0in;background:revert!important;border:revert!important;bottom:revert!important;color:revert!important;direction:revert!important;display:revert!important;font-size:revert!important;height:revert!important;letter-spacing:revert!important;line-height:revert!important;margin:revert!important;opacity:revert!important;order:revert!important;outline:revert!important;overflow:revert!important;padding:revert!important;position:revert!important;tab-size:revert!important;table-layout:revert!important;text-align:revert!important;text-indent:revert!important;text-orientation:revert!important;text-overflow:revert!important;text-transform:revert!important;top:revert!important;vertical-align:revert!important;visibility:revert!important;white-space:revert!important;width:revert!important;word-break:revert!important;word-spacing:revert!important;writing-mode:revert!important;zoom:revert!important;width:75px!important;background-color:#EAEAEA!important;padding:5px!important;font-size:12px!important;font-weight:normal!important;color:#212121!important;text-align:left!important;word-wrap:break-word!important">
</td>
</tr>
</tbody>
</table>
<div>
<div>
<p class="xmsonormal"><span style="font-size:11.0pt">Check your IdP metadata provider setting for InCommon metadata. If it is configured to use the InCommon aggregate instead of using the MDQ protocol, then check if you have set a RequiredValidUntil metadata
filter. If the maxValidityInterval is set to 14 days (P14D or some other time unit equivalent), you’ll want to temporarily increase that to 21 days. This is because recently the InCommon aggregate was published with a validUntil date 3 weeks in the future,
instead of 2 weeks.</span><o:p></o:p></p>
<p class="xmsonormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="xmsonormal"><span style="font-size:11.0pt">You can also confirm that this is the issue if you see messages like this in your idp-process.log:</span><o:p></o:p></p>
<p class="xmsonormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="xmsonormal"><span style="font-size:11.0pt">ERROR [org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver:376] - Metadata Resolver FileBackedHTTPMetadataResolver incommonaggregate: Error occurred while attempting to refresh metadata
from '<a href="https://urldefense.com/v3/__https:/mdq.incommon.org/entities__;!!MWueTNF2!Q8hDmktJ0wscZHLdJyKTLZBQP5XKDLH4UrdXaeuLlqrUR5Pc6xn7C7yzZU3fMdmn0kk746YMwVFP_-cpibzQ393J$">https://mdq.incommon.org/entities</a>'</span><o:p></o:p></p>
<p class="xmsonormal"><span style="font-size:11.0pt">net.shibboleth.utilities.java.support.resolver.ResolverException: Error filtering metadata from
<a href="https://urldefense.com/v3/__https:/mdq.incommon.org/entities__;!!MWueTNF2!Q8hDmktJ0wscZHLdJyKTLZBQP5XKDLH4UrdXaeuLlqrUR5Pc6xn7C7yzZU3fMdmn0kk746YMwVFP_-cpibzQ393J$">
https://mdq.incommon.org/entities</a></span><o:p></o:p></p>
<p class="xmsonormal"><span style="font-size:11.0pt"> at org.opensaml.saml.metadata.resolver.impl.AbstractReloadingMetadataResolver.processNonExpiredMetadata(AbstractReloadingMetadataResolver.java:552)</span><o:p></o:p></p>
<p class="xmsonormal"><span style="font-size:11.0pt">Caused by: org.opensaml.saml.metadata.resolver.filter.FilterException: Metadata's validity interval PT502H50M7.901S is larger than is allowed PT336H</span><o:p></o:p></p>
<p class="xmsonormal"><span style="font-size:11.0pt"> at org.opensaml.saml.metadata.resolver.filter.impl.RequiredValidUntilFilter.filter(RequiredValidUntilFilter.java:97)</span><o:p></o:p></p>
<p class="xmsonormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="xmsonormal"><span style="font-size:11.0pt">HTH,</span><o:p></o:p></p>
<p class="xmsonormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="xmsonormal"><span style="font-size:11.0pt">Marcus Mizushima</span><o:p></o:p></p>
<p class="xmsonormal"><span style="font-size:11.0pt">Identity Management Analyst</span><o:p></o:p></p>
<p class="xmsonormal"><span style="font-size:11.0pt">California State University, Office of the Chancellor</span><o:p></o:p></p>
<p class="xmsonormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="xmsonormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users <<a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a>>
<b>On Behalf Of </b>Mittel, Don via users<br>
<b>Sent:</b> Monday, February 17, 2025 4:46 PM<br>
<b>To:</b> Shib Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<b>Cc:</b> Mittel, Don <<a href="mailto:dmittel@depaul.edu">dmittel@depaul.edu</a>><br>
<b>Subject:</b> Shibboleth stopped working</span><o:p></o:p></p>
</div>
<p class="xmsonormal"> <o:p></o:p></p>
<div>
<p class="xmsonormal"><span style="font-size:1.0pt;color:white">Shibboleth was working find until earlier today when all of the sudden my servers started reporting errors like this: 2025-02-17 17:</span><span style="font-size:1.0pt;font-family:"Arial",sans-serif;color:white"> </span><span style="font-size:1.0pt;color:white">41:</span><span style="font-size:1.0pt;font-family:"Arial",sans-serif;color:white"> </span><span style="font-size:1.0pt;color:white">02,722
- WARN [org.</span><span style="font-size:1.0pt;font-family:"Arial",sans-serif;color:white"> </span><span style="font-size:1.0pt;color:white">opensaml.</span><span style="font-size:1.0pt;font-family:"Arial",sans-serif;color:white"> </span><span style="font-size:1.0pt;color:white">saml.</span><span style="font-size:1.0pt;font-family:"Arial",sans-serif;color:white"> </span><span style="font-size:1.0pt;color:white">metadata.</span><span style="font-size:1.0pt;font-family:"Arial",sans-serif;color:white"> </span><span style="font-size:1.0pt;color:white">resolver.</span><span style="font-size:1.0pt;font-family:"Arial",sans-serif;color:white"> </span><span style="font-size:1.0pt;color:white">impl.</span><span style="font-size:1.0pt;font-family:"Arial",sans-serif;color:white"> </span><span style="font-size:1.0pt;color:white">AbstractMetadataResolver:</span><span style="font-size:1.0pt;font-family:"Arial",sans-serif;color:white"> </span><span style="font-size:1.0pt;color:white">551]
- FileBackedHTTPMetadataResolver</span><o:p></o:p></p>
</div>
<div>
<p class="xmsonormal"><span style="color:black">Shibboleth was working find until earlier today when all of the sudden my servers started reporting errors like this:</span><o:p></o:p></p>
</div>
<div>
<p class="xmsonormal"><span style="color:black"> </span><o:p></o:p></p>
</div>
<div>
<p class="xmsonormal"><span style="color:black">2025-02-17 17:41:02,722 - WARN [org.opensaml.saml.metadata.resolver.impl.AbstractMetadataResolver:551] - FileBackedHTTPMetadataResolver ICMD: Metadata backing store contained an EntityDescriptor with the ID:
<a href="https://urldefense.com/v3/__https:/depaul-sa.terradotta.com/sp/shibboleth__;!!MWueTNF2!UUWjYdTqkZ5l9Gc_3GYfmI0NBtK-wROLfe6f9OnvwawRS4PdvekAuHWx6WIpIoYoipQpSI6YokaWXJWwpf9dUdE$">
https://depaul-sa.terradotta.com/sp/shibboleth</a>, but it was no longer valid</span><o:p></o:p></p>
</div>
<div>
<p class="xmsonormal"><span style="color:black">2025-02-17 17:41:02,722 - INFO [org.opensaml.saml.common.binding.impl.SAMLMetadataLookupHandler:185] - Message Handler: No metadata returned for
<a href="https://urldefense.com/v3/__https:/depaul-sa.terradotta.com/sp/shibboleth__;!!MWueTNF2!UUWjYdTqkZ5l9Gc_3GYfmI0NBtK-wROLfe6f9OnvwawRS4PdvekAuHWx6WIpIoYoipQpSI6YokaWXJWwpf9dUdE$">
https://depaul-sa.terradotta.com/sp/shibboleth</a> in role {urn:oasis:names:tc:SAML:2.0:metadata}SPSSODescriptor with protocol urn:oasis:names:tc:SAML:2.0:protocol</span><o:p></o:p></p>
</div>
<div>
<p class="xmsonormal"><span style="color:black">2025-02-17 17:41:02,722 - WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:164] - Profile Action SelectProfileConfiguration: Profile
<a href="https://urldefense.com/v3/__http:/shibboleth.net/ns/profiles/saml2/sso/browser__;!!MWueTNF2!UUWjYdTqkZ5l9Gc_3GYfmI0NBtK-wROLfe6f9OnvwawRS4PdvekAuHWx6WIpIoYoipQpSI6YokaWXJWwiOKxibM$">
http://shibboleth.net/ns/profiles/saml2/sso/browser</a> is not available for RP configuration shibboleth.UnverifiedRelyingParty (RPID
<a href="https://urldefense.com/v3/__https:/depaul-sa.terradotta.com/sp/shibboleth__;!!MWueTNF2!UUWjYdTqkZ5l9Gc_3GYfmI0NBtK-wROLfe6f9OnvwawRS4PdvekAuHWx6WIpIoYoipQpSI6YokaWXJWwpf9dUdE$">
https://depaul-sa.terradotta.com/sp/shibboleth</a>)</span><o:p></o:p></p>
</div>
<div>
<p class="xmsonormal"><span style="color:black">2025-02-17 17:41:02,722 - WARN [org.opensaml.profile.action.impl.LogEvent:94] - A non-proceed event occurred while processing the request: InvalidProfileConfiguration
</span><o:p></o:p></p>
</div>
<div>
<p class="xmsonormal"><span style="color:black"> </span><o:p></o:p></p>
</div>
<div>
<p class="xmsonormal"><span style="color:black">Now any time we try to access a relying party we get this error:</span><o:p></o:p></p>
</div>
<div>
<p class="xmsonormal"><span style="color:black"> </span><o:p></o:p></p>
</div>
<div>
<p class="xmsonormal"><b><span style="color:black">Unsupported Request</span></b><o:p></o:p></p>
</div>
<div>
<p class="xmsonormal"><span style="color:black">The application you have accessed is not registered for use with this service.</span><o:p></o:p></p>
</div>
<div>
<p class="xmsonormal"><span style="color:black"> </span><o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>