• Article Type: General
• Product: Primo
• Product Version: Jul-15
• Relevant for Installation Type: Dedicated-Direct; Direct; Local; Total Care

Problem Symptoms
- Unable to sign in to Primo
- Error appears before entering credentials
- PDS uses Shibboleth
- Browser error message:

opensaml::saml2md::MetadataException

The system encountered an error at Fri Oct 23 11:09:57 2015
To report this problem, please contact the site administrator at root@localhost.
Please include the following message in any email:

opensaml::saml2md::MetadataException at (https://pds-server-name/shib/INST_CODE/pds_main)

Unable to locate metadata for identity provider (https://login.customer.edu/idp/shibboleth)

- Error in /var/log/shibboleth/shibd.log:

2015-10-23 08:14:49 WARN OpenSAML.MetadataProvider [3731]: ignored expired metadata instance for (https://login.customer.edu/idp/shibboleth)
2015-10-23 08:14:49 WARN Shibboleth.SessionInitiator.SAML2 [3731]: unable to locate metadata for provider (https://login.customer.edu/idp/shibboleth)

Cause
This problem will occur when any of the following conditions are true:
- The Shibboleth MetadataProvider configuration in shibboleth2.xml is out of date
- The Shibboleth MetadataProvider configuration in shibboleth2.xml is incorrect

Resolution
1. Login as root on all PDS servers
2. Run the following commands
cd /etc/shibboleth
cp -p shibboleth2.xml shibboleth2.xml.`date +"%Y%m%d"`
3. Edit the shibboleth2.xml file
4. Search for the comment "Example of remotely supplied batch of signed metadata."
5. Add the following line after the comment:

<MetadataProvider type="XML" reloadInterval="7200" backingFilePath="InCommon-metadata.xml" uri="http://md.incommon.org/InCommon/InCommon-metadata.xml"/>

6. Remove or comment out all other <MetadataProvider> elements (see the Additional Information for examples)
7. Run the following command to restart the Shibboleth daemon:
/etc/init.d/shibd restart

<MetadataProvider type="XML" uri="http://wayf.incommonfederation.org/InCommon/InCommon-metadata.xml"
              backingFilePath="InCommon-metadata.xml" reloadInterval="7200"/>

<MetadataProvider type="XML" reloadInterval="7200" backingFilePath="InCommon-metadata.xml" uri="http://wayf.incommonfederation.org/InCommon/InCommon-metadata.xml"/>

<MetadataProvider type="XML" file="CUSTOMERidp.xml"/>