Hi Dom

Not sure if you're on the list or not so just in case...

Cheers

Guy


-----Original Message-----
From: [log in to unmask] [mailto:[log in to unmask]] On Behalf Of Ian Young
Sent: 28 March 2009 13:57
To: [log in to unmask]
Cc: [log in to unmask]
Subject: UK federation: metadata size and Shibboleth 1.3 metadatatool

Dear colleague,

You are receiving this message because you are a registered technical  
contact for an entity within the UK Access Management Federation for  
Education and Research.  The purpose of this message is to inform you  
about a recently reported problem that may affect you if your site is  
running the Shibboleth 1.3 identity provider software, and to provide  
you with a fix for the problem if this is the case.  Sites running  
other software (including the Shibboleth 1.3 SP and Shibboleth 2.x)  
are unlikely to be affected by this problem.

The Shibboleth 1.3 identity provider software includes a small Java  
language application called metadatatool, which is frequently used by  
sites to refresh their local copies of the UK federation metadata.

The UK federation metadata has recently grown to a point where,  
depending on the version of Java your site is running, metadatatool  
may require more than the default memory provided to Java command-line  
applications to process.  You may already have experienced this in the  
form of "out of memory" or other errors in your periodic refresh  
tasks.  If you have not yet experienced this problem but are using  
metadatatool, it is likely that you will soon encounter it.

The problem can be addressed simply by editing the script used to call  
the metadatatool code; this will normally be found in the /bin  
subdirectory beneath your identity provider installation.  The last  
line should be found to begin as follows:

	$JAVACMD -Djava.endorsed.dirs="$ENDORSED ...

You can increase the amount of memory allocated to the metadatatool  
application (from the default of 64MB) by inserting an appropriate  
option after $JAVACMD.  For example, to double the amount of memory  
available to metadatatool:

	$JAVACMD -Xmx128m -Djava.endorsed.dirs="$ENDORSED ...

We recommend applying this change whether or not you are currently  
experiencing problems with metadatatool, as the UK federation metadata  
is likely to slowly increase in size for the foreseeable future.

	-- Ian Young, SDSS and UK federation