IdP 3.1 - metadata config not working

[Brent Putman]

On 3/13/15 8:37 AM, Rod Widdowson wrote:
>> On 13 Mar 2015, at 11:48, Dave Perry <Dave.Perry at hull-college.ac.uk>
> wrote:
>>             <MetadataFilter xsi:type="RequiredValidUntil"
>> xmlns="urn:mace:shibboleth:2.0:metadata"
>>
>>                             maxValidityInterval="604800" />
>>
>> That maxValidityInterval value will be interpreted as a number of
> milliseconds
>> (about 10 minutes). UK federation metadata has a much longer validity
>> interval, hence the error.
> And to follow up the V2 documentation is wrong (and no one has noticed
> before).  I just checked the V2 sources (after I'd giveN myself CPr) and it
> too expects ISO format (with integral numbers of ms as the fallback).


If I'm not mistaken, this is actually a bug in v3.  The v2 parser used
the filter's constructor to handle this (there was no property setter),
and that expects seconds, not ms.  The v2 docs [1] are consistent with
that (and with the SP which also takes seconds for this functionality).

The v3 parser uses a new setMaxValidityInterval(long) filter method
that was added, and it expects ms.  The ctor which converted seconds to
ms is not used.

So both handle the duration format correctly, but there is a
change/regression in v3 in that a numeric value is treated as ms.  So a
legacy config like 604800 (seconds) is going to break, treated as
604800 ms. 

Pretty sure this is right, but Rod please check me on this.  If so, I
guess we need to open a bug.  (And I guess we can no longer laugh at
the NASA engineers who crashed the Mars probe due to a units mistake).


[1]
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPMetadataProviderExamples
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150313/7cbba6b5/attachment.html