Metadata validity interval of 24 minutes?

Daniel Smedegaard Buus danielbuus at gmail.com
Mon Oct 12 04:01:27 EDT 2015


Hey everyone :)

I'm new to Shibboleth. I've been integrating a website with WebSSO,
covering first ADFS, then Okta, and now I'm testing against
Shibboleth. I've been using the CentOS pre-configued VirtualBox IdP
image provided by IDM to test against, and I had some obstacles at
first that I needed to work through, among those a missing validUntil
attribute on my SP's federation metadata.

I initially set it to a day, thinking that seemed alright, but got
errors from Shibboleth that it was longer than what was allowed. I
don't remember what the exact allowance was, but I then set it to an
hour instead, and Shibboleth was then happy for all of Friday while I
was testing.

Weird thing is, this morning after the weekend, I open up my laptop,
and I now see that Shibboleth is erroring out in its log, saying,

Error filtering metadata from
https://browsertest.localhost/login/sso/metadata.xml
org.opensaml.saml2.metadata.provider.FilterException: Metadata's
validity interval, 237588141ms, is larger than is allowed, 86400000ms.

So now the allowed interval is 24 minutes? I haven't configured
anything other than filters and resolvers, and haven't touched the
machine during the weekend, so I'm a bit puzzled here. I can't find
anyone on Google with questions regarding these 86400000ms, so it
looks like I might be alone with this config...

Is 24 minutes really the default? I've seen Google results hinting at
a default max of 70 days...

TIA,
Daniel


More information about the users mailing list