Odd behavior of the IdP's SAML Metadata endpoint if one sets internal.xml SessionManager time to 60000

[Michael A Grady]

FYI -- I just ran into what seems quite odd behavior with the Shib IdP 2.4.0 and the SessionManager time in its "internal.xml" file. We were just trying to set that  time to a pretty short period of time, and had been using 90 seconds (90000 for setting) without any problems. I thought I'd go ahead and try setting it down even shorter, to 60 seconds (60000), and everything appears to function just fine, no messages in the log on start up, handles requests, puts up the Login page, and generates assertions just fine. But if you access the SAML metadata endpoint, you get incomplete metadata, missing the IDPSSODescriptor completely, just providing the AttributeAuthorityDescriptor section. Only discovered that because the place we are testing with setup to keep accessing that Metadata endpoint to refresh IdP metadata (which I've indicated we certainly don't want them doing in production).

I'm not sure what the "magic number" is that causes the problem, but 70 seconds (70000) is working just fine. Certainly nothing critical about this, but seemed worth noting to the list.

--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.