How to set the SP metadata expiration date

[Yaowen Tu]

Thanks Tom, some follow up questions then:

1) As you suggested, I read the SAML spec. In saml-metadata-2.0-os.pdf,
when describing the <EntitiesDescriptor> and <EntityDescriptor> element, I
found this sentense:
              When used as the root element of a metadata instance, this
element MUST contain either a validUntil
or cacheDuration attribute.
    Does it mean in the metadata, the root <EntityDescriptor> needs to
include "validUntil"? Why you said it is optional?


2) If I want to use Shibboleth SP. How can I produce a production level
metadata file? Do I need to manually edit it based on what ever Shib SP has
generated?

Thanks,
Yaowen


On Wed, Oct 17, 2012 at 5:43 PM, Tom Scavo <trscavo at gmail.com> wrote:

> On Wed, Oct 17, 2012 at 7:42 PM, Yaowen Tu <yaowen.tu at gmail.com> wrote:
> > I don't see "validUntil" attribute in OOTB Shibboleth SP metadata.
> Several
> > question about this:
> >
> > 1) In SAML, is it required to have "validUntil" attribute in production
> SP
> > server?
>
> A SAML SP is not required to use SAML metadata. Likewise SAML metadata
> need not contain a validUntil attribute. You can (and should) verify
> these claims in the SAML specs.
>
> > 2) In Shibboleth SP, how to config it to include this attribute?
> > 3) Once the metadata expires, does the Shib SP automatically re-generate
> the
> > metadata or we need to restart the server?
>
> How you produce metadata is out of scope with respect to the SP
> software. The Shibboleth SP produces some initial metadata for you,
> but that metadata is not intended to be used in a production setting.
>
> > 4) Suppose our SP re-generates the metadata, can we assume that IdP will
> > also update the SP metadata automatically?
>
> I dearly wish that were true but unfortunately it doesn't work that
> way! In a distributed system, the SP has absolutely no control over
> IdP behavior. You should of course obtain assurances beforehand that
> the IdP will do the right thing, but this is part of the trust
> relationship between SP and IdP. You either trust your partner to do
> the right thing or you don't. If the IdP fails to do the right thing,
> you will suffer, surely.
>
> Sounds like a human relationship, right? That's federation for you :-)
>
> Tom
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121018/8a520c4a/attachment.html