Namespace: urn:mace:shibboleth:2.0:metadata
Schema: http://shibboleth.net/schema/idp/shibboleth-metadata.xsd
...
Localtabgroup |
---|
Localtab |
---|
active | true |
---|
title | XML Attributes |
---|
| Name | Type | Req? | Default | Description |
---|
metadataURL
| URL | Y |
| The URL that the metadata is served from | backingFile | File pathname | Y |
| Specifies where the backing file is located. If the remote server is unavailable at startup, the backing file is loaded instead. | initializeFromBackupFile | Boolean |
| true | Flag indicating whether initialization should first attempt to load metadata from the backup file. If true, foreground initialization will be performed by loading the backing file, and then a refresh from the remote HTTP server will be scheduled to execute in a background thread, after a configured delay. This can improve IdP startup times when the remote HTTP file is large in size. | backupFileInitNextRefreshDelay | Delay (ISO8601 format) |
| PT5S | Delay duration after which to schedule next HTTP refresh when initialized from the backing file |
|
Localtab |
---|
| Name | Cardinality | Description |
---|
<TLSTrustEngine> | 0 or 1 | A custom TrustEngine used to evaluate TLS server certificates. It contains a single <security:TrustEngine> element. |
|
Localtab |
---|
id | CommonAttributes |
---|
title | Common XML Attributes |
---|
| Include Page |
---|
| MetadataProviderCommonAttributes |
---|
| MetadataProviderCommonAttributes |
---|
|
|
Localtab |
---|
id | ReloadingAttributes |
---|
title | Reloading XML Attributes |
---|
| Include Page |
---|
| MetadataProviderReloadingAttributes |
---|
| MetadataProviderReloadingAttributes |
---|
|
|
Localtab |
---|
id | HTTPAttributes |
---|
title | HTTP XML Attributes |
---|
| Include Page |
---|
| MetadataProviderHTTPAttributes |
---|
| MetadataProviderHTTPAttributes |
---|
|
For a FileBackedHTTPMetadataProvider , the HTTP Connection Attributes have the following default timeout values: | Name | Default |
---|
connectionRequestTimeout | PT60S (60 seconds) | connectionTimeout | PT60S (60 seconds) | socketTimeout | PT60S (60 seconds) | each have a 60 second timeout default. Since the batch metadata refresh process runs in a background thread, a browser user will not notice such a delay.
Localtab |
---|
| Include Page |
---|
| MetadataProviderChildElements |
---|
| MetadataProviderChildElements |
---|
|
|
|
...
See also Troubleshooting.
A FileBackedHTTPMetadataProvider
loads (and reloads) metadata in the background, independent of normal IdP operation. The frequency of metadata refresh is influenced by the Reloading Attributes. In particular, the minRefreshDelay
and maxRefreshDelay
attributes strongly influence the frequency of metadata refresh. Any cacheDuration
and validUntil
attributes in the metadata itself also influence the process.
...
A conforming server will respond to an HTTP conditional GET request (RFC 7232) with a 304 (Not Modified) status code if the target resource has not changed since the last time it was requested. Note that a 304 response does not include a response body, which is more efficient than the corresponding 200 response (especially for large metadata files). More importantly, due to the manner in which the FileBackedHTTPMetadataProvider
is implemented, the IdP can safely ignore a 304 response, which precludes the need to redundantly process the metadata. For large signed metadata files, the savings can be quite significant.
...
The backing file is only used at startup. If the remote server is unavailable at startup, the backing file is loaded instead and all the configured filters are run on the backing file. If a single filter fails, the backing file is not loaded. For example, if the provider contains a SignatureValidationFilter but the signature on the backing file can not be verified, the entire load operation fails.
...