Metadata validity interval of 24 minutes?
Daniel Smedegaard Buus
danielbuus at gmail.com
Mon Oct 12 04:01:27 EDT 2015
Hey everyone :)
I'm new to Shibboleth. I've been integrating a website with WebSSO,
covering first ADFS, then Okta, and now I'm testing against
Shibboleth. I've been using the CentOS pre-configued VirtualBox IdP
image provided by IDM to test against, and I had some obstacles at
first that I needed to work through, among those a missing validUntil
attribute on my SP's federation metadata.
I initially set it to a day, thinking that seemed alright, but got
errors from Shibboleth that it was longer than what was allowed. I
don't remember what the exact allowance was, but I then set it to an
hour instead, and Shibboleth was then happy for all of Friday while I
was testing.
Weird thing is, this morning after the weekend, I open up my laptop,
and I now see that Shibboleth is erroring out in its log, saying,
Error filtering metadata from
https://browsertest.localhost/login/sso/metadata.xml
org.opensaml.saml2.metadata.provider.FilterException: Metadata's
validity interval, 237588141ms, is larger than is allowed, 86400000ms.
So now the allowed interval is 24 minutes? I haven't configured
anything other than filters and resolvers, and haven't touched the
machine during the weekend, so I'm a bit puzzled here. I can't find
anyone on Google with questions regarding these 86400000ms, so it
looks like I might be alone with this config...
Is 24 minutes really the default? I've seen Google results hinting at
a default max of 70 days...
TIA,
Daniel
More information about the users
mailing list