[Shib-Users] Unable to read metadata from remote server [Scanned]
Nathan Friend
I'm setting up a test IDP. When I run startup.sh the following occurs:
v-shibboleth:/usr/local/idp/logs # tail -f idp-process.log
15:33:25.774 - DEBUG
[edu.internet2.middleware.shibboleth.common.config.OpensamlConfigBean:
56] - Loading OpenSAML configuration file: jar:file:/opt/tomcat/
webapps/idp/WEB-INF/lib/shibboleth-common-1.1.1.jar!/shibboleth-saml-
ext-config.xml
15:33:25.872 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.service.ServletContextAttributeExporter
:84] - Exporting bean shibboleth.SessionManager to servlet context.
15:33:25.884 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.BaseReloadableService:135] -
Initializing shibboleth.AttributeResolver service with resources: [/
usr/local/idp/conf/attribute-resolver.xml]
15:33:25.884 - INFO
[edu.internet2.middleware.shibboleth.common.config.BaseService:157] -
Loading configuration for service: shibboleth.AttributeResolver
15:33:26.059 - INFO
[edu.internet2
.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser
:54] - Parsing configuration for PrincipalConnector plugin with ID:
shibTransient
15:33:26.060 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser
:60] - Setting the following attribute definition dependencies for
plugin shibTransient: null
15:33:26.060 - INFO
[edu.internet2
.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser
:54] - Parsing configuration for PrincipalConnector plugin with ID:
saml1Unspec
15:33:26.061 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser
:60] - Setting the following attribute definition dependencies for
plugin saml1Unspec: null
15:33:26.061 - INFO
[edu.internet2
.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser
:54] - Parsing configuration for PrincipalConnector plugin with ID:
saml2Transient
15:33:26.061 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser
:60] - Setting the following attribute definition dependencies for
plugin saml2Transient: null
15:33:26.075 - INFO
[edu.internet2
.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser
:54] - Parsing configuration for AttributeDefinition plugin with ID:
transientId
15:33:26.075 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.attribute.resolver.AbstractResolutionPlugInBeanDefinitionParser
:60] - Setting the following attribute definition dependencies for
plugin transientId: null
15:33:26.075 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.attribute.resolver.attributeDefinition.BaseAttributeDefinitionBeanDefinitionParser
:57] - Setting source attribute ID for attribute definition
transientId to:
15:33:26.076 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.attribute.resolver.attributeDefinition.BaseAttributeDefinitionBeanDefinitionParser
:81] - Attribute definition transientId produces attributes that are
only dependencies: false
15:33:55.839 - DEBUG
[edu.internet2
.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver
:479] - Loading 0 data connectors
15:33:55.839 - DEBUG
[edu.internet2
.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver
:489] - Loading 1 attribute definitions
15:33:55.839 - DEBUG
[edu.internet2
.middleware.shibboleth.common.attribute.resolver.provider.ShibbolethAttributeResolver
:499] - Loading 3 principal connectors
15:33:55.856 - INFO
[edu.internet2.middleware.shibboleth.common.config.BaseService:179] -
shibboleth.AttributeResolver service configuration loaded
15:33:55.864 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.BaseReloadableService:135] -
Initializing shibboleth.AttributeFilterEngine service with resources:
[/usr/local/idp/conf/attribute-filter.xml]
15:33:55.864 - INFO
[edu.internet2.middleware.shibboleth.common.config.BaseService:157] -
Loading configuration for service: shibboleth.AttributeFilterEngine
15:33:55.884 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.attribute.filtering.AttributeFilterPolicyGroupBeanDefinitionParser
:63] - Parsing attribute filter policy group ShibbolethFilterPolicy
15:33:55.885 - INFO
[edu.internet2
.middleware.shibboleth.common.config.attribute.filtering.AttributeFilterPolicyBeanDefinitionParser
:71] - Parsing configuration for attribute filter policy
releaseTransientIdToAnyone
15:33:55.905 - INFO
[edu.internet2.middleware.shibboleth.common.config.BaseService:179] -
shibboleth.AttributeFilterEngine service configuration loaded
15:33:55.911 - INFO
[edu.internet2.middleware.shibboleth.common.config.BaseService:157] -
Loading configuration for service: shibboleth.SAML1AttributeAuthority
15:33:55.915 - INFO
[edu.internet2.middleware.shibboleth.common.config.BaseService:157] -
Loading configuration for service: shibboleth.SAML2AttributeAuthority
15:33:55.920 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.BaseReloadableService:135] -
Initializing shibboleth.RelyingPartyConfigurationManager service with
resources: [/usr/local/idp/conf/relying-party.xml]
15:33:55.921 - INFO
[edu.internet2.middleware.shibboleth.common.config.BaseService:157] -
Loading configuration for service:
shibboleth.RelyingPartyConfigurationManager
15:33:56.118 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.metadata.BaseMetadataProviderBeanDefinitionParser
:41] - Parsing configuration for ChainingMetadataProvider metadata
provider with ID: ShibbolethMetadata
15:33:56.118 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.metadata.BaseMetadataProviderBeanDefinitionParser
:50] - Metadata provider ShibbolethMetadata requires valid metadata:
false
15:33:56.120 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.metadata.BaseMetadataProviderBeanDefinitionParser
:41] - Parsing configuration for ResourceBackedMetadataProvider
metadata provider with ID: IdPMD
15:33:56.121 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.metadata.BaseMetadataProviderBeanDefinitionParser
:50] - Metadata provider IdPMD requires valid metadata: false
15:33:56.122 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.metadata.BaseMetadataProviderBeanDefinitionParser
:41] - Parsing configuration for FileBackedHTTPMetadataProvider
metadata provider with ID: URLMD
15:33:56.123 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.metadata.BaseMetadataProviderBeanDefinitionParser
:50] - Metadata provider URLMD requires valid metadata: false
15:33:56.124 - INFO
[edu.internet2
.middleware.shibboleth.common.config.relyingparty.RelyingPartyConfigurationBeanDefinitionParser
:71] - Parsing configuration for relying party with id: anonymous
15:33:56.124 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.relyingparty.RelyingPartyConfigurationBeanDefinitionParser
:75] - Relying party configuration - provider ID: https://v-shibboleth.cant-col.ac.uk/idp/shibboleth
15:33:56.124 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.relyingparty.RelyingPartyConfigurationBeanDefinitionParser
:80] - Relying party configuration - default authentication method: null
15:33:56.124 - INFO
[edu.internet2
.middleware.shibboleth.common.config.relyingparty.RelyingPartyConfigurationBeanDefinitionParser
:71] - Parsing configuration for relying party with id: default
15:33:56.125 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.relyingparty.RelyingPartyConfigurationBeanDefinitionParser
:75] - Relying party configuration - provider ID: https://v-shibboleth.cant-col.ac.uk/idp/shibboleth
15:33:56.125 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.relyingparty.RelyingPartyConfigurationBeanDefinitionParser
:80] - Relying party configuration - default authentication method: null
15:33:56.125 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.relyingparty.RelyingPartyConfigurationBeanDefinitionParser
:86] - Relying party configuration - default signing credential:
IdPCredential
15:33:56.126 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.relyingparty.RelyingPartyConfigurationBeanDefinitionParser
:93] - Relying party configuration - 6 profile configurations
15:33:56.177 - INFO
[edu.internet2
.middleware.shibboleth.common.config.security.AbstractX509CredentialBeanDefinitionParser
:62] - Parsing configuration for X509Filesystem credential with id:
IdPCredential
15:33:56.178 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.security.AbstractCredentialBeanDefinitionParser
:90] - Parsing credential key names
15:33:56.179 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.security.AbstractCredentialBeanDefinitionParser
:120] - Parsing credential private key
15:33:56.797 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.security.AbstractX509CredentialBeanDefinitionParser
:88] - Parsing x509 credential certificates
15:33:56.930 - INFO
[edu.internet2
.middleware.shibboleth.common.config.security.ChainingSignatureTrustEngineBeanDefinitionParser
:58] - Parsing configuration for SignatureChaining trust engine with
id: shibboleth.SignatureTrustEngine
15:33:56.930 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.security.ChainingSignatureTrustEngineBeanDefinitionParser
:67] - Parsing chain trust engine member shibboleth.SignatureTrustEngine
15:33:56.931 - INFO
[edu.internet2
.middleware.shibboleth.common.config.security.MetadataExplicitKeySignatureTrustEngineBeanDefinitionParser
:49] - Parsing configuration for MetadataExplicitKeySignature trust
engine with id: shibboleth.SignatureMetadataExplicitKeyTrustEngine
15:33:56.931 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.security.ChainingSignatureTrustEngineBeanDefinitionParser
:67] - Parsing chain trust engine member shibboleth.SignatureTrustEngine
15:33:56.961 - INFO
[edu.internet2
.middleware.shibboleth.common.config.security.MetadataPKIXSignatureTrustEngineBeanDefinitionParser
:47] - Parsing configuration for MetadataPKIXSignature trust engine
with id: shibboleth.SignatureMetadataPKIXTrustEngine
15:33:56.962 - INFO
[edu.internet2
.middleware.shibboleth.common.config.security.ChainingTrustEngineBeanDefinitionParser
:58] - Parsing configuration for Chaining trust engine with id:
shibboleth.CredentialTrustEngine
15:33:56.962 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.security.ChainingTrustEngineBeanDefinitionParser
:67] - Parsing chain trust engine member
shibboleth.CredentialTrustEngine
15:33:56.963 - INFO
[edu.internet2
.middleware.shibboleth.common.config.security.MetadataExplicitKeyTrustEngineBeanDefinitionParser
:47] - Parsing configuration for MetadataExplicitKey trust engine with
id: shibboleth.CredentialMetadataExplictKeyTrustEngine
15:33:56.963 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.security.ChainingTrustEngineBeanDefinitionParser
:67] - Parsing chain trust engine member
shibboleth.CredentialTrustEngine
15:33:56.964 - INFO
[edu.internet2
.middleware.shibboleth.common.config.security.MetadataPKIXX509CredentialTrustEngineBeanDefinitionParser
:47] - Parsing configuration for MetadataPKIXX509Credential trust
engine with id: shibboleth.CredentialMetadataPKIXTrustEngine
15:33:56.965 - INFO
[edu.internet2
.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser
:58] - Parsing configuration for SecurityPolicyType security policy
with id: shibboleth.ShibbolethSSOSecurityPolicy
15:33:56.965 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser
:62] - Configuring security policy:
shibboleth.ShibbolethSSOSecurityPolicy
15:33:56.988 - INFO
[edu.internet2
.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser
:58] - Parsing configuration for SecurityPolicyType security policy
with id: shibboleth.SAML1AttributeQuerySecurityPolicy
15:33:56.989 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser
:62] - Configuring security policy:
shibboleth.SAML1AttributeQuerySecurityPolicy
15:33:57.015 - INFO
[edu.internet2
.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser
:58] - Parsing configuration for SecurityPolicyType security policy
with id: shibboleth.SAML1ArtifactResolutionSecurityPolicy
15:33:57.015 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser
:62] - Configuring security policy:
shibboleth.SAML1ArtifactResolutionSecurityPolicy
15:33:57.017 - INFO
[edu.internet2
.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser
:58] - Parsing configuration for SecurityPolicyType security policy
with id: shibboleth.SAML2SSOSecurityPolicy
15:33:57.017 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser
:62] - Configuring security policy: shibboleth.SAML2SSOSecurityPolicy
15:33:57.038 - INFO
[edu.internet2
.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser
:58] - Parsing configuration for SecurityPolicyType security policy
with id: shibboleth.SAML2AttributeQuerySecurityPolicy
15:33:57.038 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser
:62] - Configuring security policy:
shibboleth.SAML2AttributeQuerySecurityPolicy
15:33:57.040 - INFO
[edu.internet2
.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser
:58] - Parsing configuration for SecurityPolicyType security policy
with id: shibboleth.SAML2ArtifactResolutionSecurityPolicy
15:33:57.040 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser
:62] - Configuring security policy:
shibboleth.SAML2ArtifactResolutionSecurityPolicy
15:33:57.060 - INFO
[edu.internet2
.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser
:58] - Parsing configuration for SecurityPolicyType security policy
with id: shibboleth.SAML2SLOSecurityPolicy
15:33:57.061 - DEBUG
[edu.internet2
.middleware.shibboleth.common.config.security.ShibbolethSecurityPolicyBeanDefinitionParser
:62] - Configuring security policy: shibboleth.SAML2SLOSecurityPolicy
15:46:33.411 - WARN
[org.opensaml.saml2.metadata.provider.FileBackedHTTPMetadataProvider:
101] - Unable to read metadata from remote server, attempting to read
it from local backup
java.net.ConnectException: Connection timed out
at java.net.PlainSocketImpl.socketConnect(Native Method) [na:1.6.0_17]
-Snip
----------------------
From relying-party.xml
<!-- ========================================== -->
<!-- Metadata Configuration -->
<!-- ========================================== -->
<!-- MetadataProvider the combining other MetadataProviders -->
<MetadataProvider id="ShibbolethMetadata"
xsi:type="ChainingMetadataProvider" xmlns="urn:mace:shibboleth:
2.0:metadata">
<!-- Load the IdP's own metadata. This is necessary for artifact
support. -->
<MetadataProvider id="IdPMD"
xsi:type="ResourceBackedMetadataProvider" xmlns="urn:mace:shibboleth:
2.0:metadata" >
<MetadataResource xsi:type="resource:FilesystemResource"
file="/usr/local/idp/metadata/idp-metadata.xml" />
</MetadataProvider>
<!-- Example metadata provider. -->
<!-- Reads metadata from a URL and store a backup copy on the
file system. -->
<!-- Validates the signature of the metadata and filters out
all by SP entities in order to save memory -->
<!-- To use: fill in 'metadataURL' and 'backingFile'
properties on MetadataResource element -->
<MetadataProvider id="URLMD"
xsi:type="FileBackedHTTPMetadataProvider" xmlns="urn:mace:shibboleth:
2.0:metadata"
metadataURL="http://www.testshib.org/metadata/testshib-providers.xml
"
backingFile="/usr/local/idp/metadata/
testshib.xml">
<!-- <MetadataFilter xsi:type="ChainingFilter"
xmlns="urn:mace:shibboleth:2.0:metadata">
<MetadataFilter xsi:type="RequiredValidUntil"
xmlns="urn:mace:shibboleth:2.0:metadata"
maxValidityInterval="604800" />
<MetadataFilter xsi:type="SignatureValidation"
xmlns="urn:mace:shibboleth:2.0:metadata"
trustEngineRef="shibboleth.MetadataTrustEngine"
requireSignedMetadata="true" />
<MetadataFilter xsi:type="EntityRoleWhiteList"
xmlns="urn:mace:shibboleth:2.0:metadata">
<RetainedRole>samlmd:SPSSODescriptor</RetainedRole>
</MetadataFilter>
</MetadataFilter> -->
</MetadataProvider>
</MetadataProvider>
Any advice on how to proceed?
Many thanks,
Nathan.
Chad La Joie
connection timed out. It's probably some sort of network issue between
you and the testshib site.
Nathan Friend wrote:
> 15:46:33.411 - WARN
> [org.opensaml.saml2.metadata.provider.FileBackedHTTPMetadataProvider:101]
> - Unable to read metadata from remote server, attempting to read it from
> local backup
> java.net.ConnectException: Connection timed out
> at java.net.PlainSocketImpl.socketConnect(Native Method) [na:1.6.0_17]
> Any advice on how to proceed?
--
SWITCH
Serving Swiss Universities
--------------------------
Chad La Joie, Software Engineer, Net Services
Werdstrasse 2, P.O. Box, 8021 Zürich, Switzerland
phone +41 44 268 15 75, fax +41 44 268 15 68
chad....@switch.ch, http://www.switch.ch
Nathan Friend
For example I can wget http://www.testshib.org/metadata/testshib-providers.xml
as specified in relying-party.xml
Nathan.
Scott Cantor
> Which file is the error referring to?
>
> For example I can wget http://www.testshib.org/metadata/testshib-
> providers.xml
> as specified in relying-party.xml
You may be able to, but apparently it can't. Or maybe you have a hidden typo
in the config file.
-- Scott
Nathan Friend
I've opened and made edits to config files using jEdit, context
highlighting has helped identify typos. Nothings jumping out at me
but I'll take another look.
Maybe it's downloading the config but can't write it to disk, what
group membership and permissions should /usr/local/idp/* have? I've
tried running startup.sh as root, this resulted in the same timeout
error.
Cheers,
Nathan.
Chad La Joie
can't write it to disk. So, running as root isn't going to make any
difference. Do you have an HTTP proxy that is getting in the way of things?
--
Nathan Friend
problem when trying to wget. So I changed to another proxy we have
for testing that has no authentication and runs on 8080.
Will Tomcat use the system defaults of proxy access e.g. /etc/sysconf/
proxy or do I need to specify proxy settings elsewhere?
Nathan.
Chad La Joie
Nathan Friend wrote:
> Yes we do have a proxy. Originally I was getting an authentication
> problem when trying to wget. So I changed to another proxy we have for
> testing that has no authentication and runs on 8080.
>
> Will Tomcat use the system defaults of proxy access e.g.
> /etc/sysconf/proxy or do I need to specify proxy settings elsewhere?
Nathan Friend
Scott Cantor
> OK so a direct root out/in on port 80 is required?
Has nothing to do with root, it just needs direct access out, or you need to
script your own metadata refresh with wget or something and use a local file
instead.
-- Scott
Chad La Joie
Nathan Friend wrote:
> OK so a direct root out/in on port 80 is required?
--
Nathan Friend
OK I've setup a wget cronjob to keep the testshib-providers.xml file
fresh. How should the MetadataProvider section be formed to go
straight to the local file, like this?
<MetadataProvider id="URLMD"
xsi:type="FileBackedHTTPMetadataProvider" xmlns="urn:mace:shibboleth:
2.0:metadata" backingFile="/usr/local/idp/metadata/testshib-
providers.xml">
Nathan.
Peter Schober
> OK I've setup a wget cronjob to keep the testshib-providers.xml file
> fresh.
For whatever reason you want that.
> How should the MetadataProvider section be formed to go straight to
> the local file, like this?
By looking at the official documentation?
-peter
Scott Cantor
> Sorry I ment route that time!
>
> OK I've setup a wget cronjob to keep the testshib-providers.xml file
> fresh.
Testshib itself is irrelvant, it's not for real world use. I was just making
the broader point.
> How should the MetadataProvider section be formed to go
> straight to the local file, like this?
No, that's not the plugin to use for local files, nor do I know which one
is. I'd have to refer to the documentation.
-- Scott