Namespace: urn:mace:shibboleth:2.0:metadata
Schema: http://shibboleth.net/schema/idp/shibboleth-metadata.xsd
...
| Expand |
|---|
| title | Specific XML Attributes |
|---|
|
Name | Type | Req? | Default | Description |
|---|
metadataURL | URL | Y | | The URL that the metadata is served from | backingFile | File pathname | Y |
| Specifies where the backing file is located. If the remote server is unavailable at startup, the backing file is loaded instead. | initializeFromBackupFile | Boolean | | true | Flag indicating whether initialization should first attempt to load metadata from the backup file. If true, foreground initialization will be performed by loading the backing file, and then a refresh from the remote HTTP server will be scheduled to execute in a background thread, after a configured delay. This can improve IdP startup times when the remote HTTP file is large in size. | backupFileInitNextRefreshDelay | Delay (ISO8601 format) | | PT5S | Delay duration after which to schedule next HTTP refresh when initialized from the backing file |
|
| Expand |
|---|
| title | Specific XML Elements |
|---|
|
Name | Cardinality | Description |
|---|
<TLSTrustEngine> | 0 or 1 | A custom TrustEngine used to evaluate TLS server certificates. It contains a single <security:TrustEngine> element. |
|
| Expand |
|---|
| title | Common XML Attributes |
|---|
|
| Include Page |
|---|
| IDP5:MetadataProviderCommonAttributesIDP5: |
|---|
| MetadataProviderCommonAttributes |
|---|
|
|
| Expand |
|---|
| title | Reloading XML Attributes |
|---|
|
| Include Page |
|---|
| IDP5:MetadataProviderReloadingAttributesIDP5: |
|---|
| MetadataProviderReloadingAttributes |
|---|
|
|
| Expand |
|---|
|
| Include Page |
|---|
| IDP5:MetadataProviderHTTPAttributesIDP5: |
|---|
| MetadataProviderHTTPAttributes |
|---|
|
For a FileBackedHTTPMetadataProvider, the HTTP Connection Attributes each have a 60 second timeout default. Since the batch metadata refresh process runs in a background thread, a browser user will not notice such a delay |
| Expand |
|---|
|
| Include Page |
|---|
| IDP5:MetadataProviderChildElementsIDP5: |
|---|
| MetadataProviderChildElements |
|---|
|
|
...
A typical use of FileBackedHTTPMetadataProvider is to load (and periodically reload) a metadata aggregate from a remote source via HTTP:
| Include Page |
|---|
| IDP5:RemoteMetadataAggregateExampleIDP5: |
|---|
| RemoteMetadataAggregateExample |
|---|
|
...
See also Troubleshooting.
A FileBackedHTTPMetadataProvider loads (and reloads) metadata in the background, independent of normal IdP operation. The frequency of metadata refresh is influenced by the Reloading Attributes. In particular, the minRefreshDelay and maxRefreshDelay attributes strongly influence the frequency of metadata refresh. Any cacheDuration and validUntil attributes in the metadata itself also influence the process.
...
There are at least two things you can do to help minimize the impact of the metadata refresh process: 1) install and configure adequate memory on your system, and 2) customize the frequency of metadata refresh for optimal performance. In any case, the FileBackedHTTPMetadataProvider implementation has two features that positively affect metadata refresh: background processing and HTTP conditional GET. Neither of these features is configurable, however, so there is nothing further you need to do beyond the two items mentioned above.
| Anchor |
|---|
| HTTPConditionalGET |
|---|
| HTTPConditionalGET |
|---|
|
What is HTTP conditional GET?A conforming server will respond to an HTTP conditional GET request (RFC 7232) with a 304 (Not Modified) status code if the target resource has not changed since the last time it was requested. Note that a 304 response does not include a response body, which is more efficient than the corresponding 200 response (especially for large metadata files). More importantly, due to the manner in which the FileBackedHTTPMetadataProvider is implemented, the IdP can safely ignore a 304 response, which precludes the need to redundantly process the metadata. For large signed metadata files, the savings can be quite significant.
How do I customize the frequency of metadata refresh?
To influence the frequency of metadata refresh, configure the following attributes on a FileBackedHTTPMetadataProvider instance: minRefreshDelay, maxRefreshDelay, and refreshDelayFactor. Optimal values for these attributes depend on 1) whether or not the server supports HTTP conditional GET, 2) the life cycle of metadata published on the server, and possibly other factors. Ask the metadata publisher for recommended best practices with respect to published metadata.
What is the backing file used for?
...
If a FileBackedHTTPMetadataProvider is unable to load the backing file at startup, and the failFastInitialization attribute on the provider is set to true (the default), the metadata initialization process will halt. Additionally, if the idp.service.metadata.failFast property is set to true (not the default), the IdP as a whole will fail to initialize.
Does the provider support HTTP caching?
Yes, it does so internally, though not across restarts of the system (it will not have a cache tag at startup but will maintain one in memory after the initial request for metadata and do conditional GETs until the next restart).