How to set the SP metadata expiration date

[Tom Scavo]

On Wed, Oct 17, 2012 at 7:42 PM, Yaowen Tu <yaowen.tu at gmail.com> wrote:
> I don't see "validUntil" attribute in OOTB Shibboleth SP metadata. Several
> question about this:
>
> 1) In SAML, is it required to have "validUntil" attribute in production SP
> server?

A SAML SP is not required to use SAML metadata. Likewise SAML metadata
need not contain a validUntil attribute. You can (and should) verify
these claims in the SAML specs.

> 2) In Shibboleth SP, how to config it to include this attribute?
> 3) Once the metadata expires, does the Shib SP automatically re-generate the
> metadata or we need to restart the server?

How you produce metadata is out of scope with respect to the SP
software. The Shibboleth SP produces some initial metadata for you,
but that metadata is not intended to be used in a production setting.

> 4) Suppose our SP re-generates the metadata, can we assume that IdP will
> also update the SP metadata automatically?

I dearly wish that were true but unfortunately it doesn't work that
way! In a distributed system, the SP has absolutely no control over
IdP behavior. You should of course obtain assurances beforehand that
the IdP will do the right thing, but this is part of the trust
relationship between SP and IdP. You either trust your partner to do
the right thing or you don't. If the IdP fails to do the right thing,
you will suffer, surely.

Sounds like a human relationship, right? That's federation for you :-)

Tom