Editing Shibboleth (section)

=== Using Remote IdP Metatdata ===

As IdP Metadata may expire, you may want to use the remote metadata URL rather than a local copy.  This is what you need to do to switch to using remote IdP metadata:

* Edit the '''MetadataProvider''' line to something like the following.  The reloadInterval is best set to 7200 but this can be set less frequently:

 <MetadataProvider type="XML" url="https://shib.foo.example.org/idp/metadata.xml" backingFilePath="foo/idp-metadata.xml" reloadInterval="7200"/>

* Make sure the reloadInterval is appropriate for the IdP metadata you are downloading.  If you have large metadata file,(e.g. from a federated metadata service containing metadata for other IdPs), then it may be better to set this higher than the default.  However, the configuration checker may warn you that your reload interval is too long, so you may have to choose to ignore this, if you want to avoid downloading a large federated metadata file too often.

* Make sure that the directory '''/etc/shibboleth/foo/''' and '''/etc/shibboleth/foo/idp-metadata.xml''' if it already exists) are owned by '''shibd''':

 chown shibd:shibd /etc/shibboleth/foo/
 chown shibd:shibd /etc/shibboleth/foo/idp-metadata.xml

* To test Shibboleth you will need to make sure your '''LD_LIBRARY_PATH''' is set the same as shibd would have when started using ''systemctl shibd start''.
 
 LD_LIBRARY_PATH=/opt/shibboleth/lib64:$LD_LIBRARY_PATH shibd -t
This should return the message: ''overall configuration is loadable, check console for non-fatal problems''.

* The above message is because it is now advised not to leave the MetadataGenerator enabled unnecessarily.  However, whilst you are setting up Shibboleth, it is useful to have the metadata generator, save you needing to build your own Service Provider metadata file to register with your Identity Provider.  Later on you can comment out the MetadataGenerator line to stop getting this warning message.

* Now you can restart '''shibd''' properly:

 systemctl restart shibd