MetadataReload

Overview

This service reloads a specific <MetadataProvider> plugin via the id specified in the MetadataConfiguration. In the case of dynamic resolvers, a reload will clear the state of the resolver's in-memory cache.

<MetadataProvider id="nameUsedbelow" xsi:type="Whatever" .... >

The underlying web interface, which is managed as an AdministrativeConfiguration, looks like this:

http[s]://localhost/idp/profile/admin/reload-metadata?id=nameSpecifiedAbove

The same thing on the command line would be:

$ /opt/shibboleth-idp/bin/reload-metadata.sh -id nameSpecifiedAbove

The parameters supported and their corresponding command line options are:

Query String

Command Line

Description

Query String

Command Line

Description

id

--provider, -id

Metadata Resolver to reload

The identifiers of the resolvers are also listed by the status and metrics administrative flows.

Reference

The general properties configuring this flow via admin/admin.properties are:

Name

Default

Description

Name

Default

Description

idp.reload.logging

Reload

Audit log identifier for flow

idp.reload.accessPolicy

AccessByIPAddress

Name of access control policy for request authorization

idp.reload.authenticated

false

Whether authentication should be performed prior to access control evaluation

idp.reload.nonBrowserSupported

false

Whether the flow should allow for non-browser clients during authentication

idp.reload.resolveAttributes

false

Whether attributes should be resolved prior to access control evaluation

To replace the internally defined flow descriptor bean, the following XML is required:

<util:list id="shibboleth.AvailableAdminFlows"> <bean parent="shibboleth.AdminFlow" c:id="http://shibboleth.net/ns/profiles/reload-metadata" p:loggingId="%{idp.reload.logging:Reload}" p:policyName="%{idp.reload.accessPolicy:AccessByIPAddress}" p:nonBrowserSupported="%{idp.reload.nonBrowserSupported:false}" p:authenticated="%{idp.reload.authenticated:false}" p:resolveAttributes="%{idp.reload.resolveAttributes:false}" /> </util:list>

No default version of the list is provided and it may simply be placed in conf/global.xml if needed.