Metadata validity interval of 24 minutes?

[Daniel Smedegaard Buus]

LOL, hi Søren :D Funny finding you here :) How's it going?

Well, it's pretty strange — I have the SP configured as a relying
party on the IdP with a MatadataProvider.maxValidityInterval="P1D", so
it should be one day...

Restarting tomcat on that machine made Shibboleth error out
immediately on starting with the same error while loading the
metadata. I then set it to P1M, and it works fine again.

In fact, the only change since Friday, is that more than 1 day has
passed, so I guess something's amiss there. The SP fetadata is
generated on each request, and the http cache headers are set to 1
hour.

I do note upon Googling, that some related bugs were fixed in 2.4, and
this IDM virtual machine is running 2.3.3.

I'm really just testing against it, and I'm gonna kill it eventually,
so I guess I'l just have to make a client requirement of anyone using
Shibboleth to be fully upgraded and knowledgable about how to use it
(more than I am, anyway ;) )

Does this sound like something 2.3.3 might have probs with to you?

Cheers,
Daniel :)

On Mon, Oct 12, 2015 at 10:16 AM, Søren Grønning <s.groening at gmail.com> wrote:
> Hi Daniel
>
> What is your 'valid until' metadata value set to on both IdP and SP?
>
> It would seem to be a conflict between the two values that causes the error.
>
> It seems similar to this occurrence :
>
> https://lists.internet2.edu/sympa/arc/shibboleth-users/2008-11/msg00343.html
>
> Best regards,
>
> Søren Grønning
>
> On Oct 12, 2015 10:02, "Daniel Smedegaard Buus" <danielbuus at gmail.com>
> wrote:
>
> Hey everyone :)
>
> I'm new to Shibboleth. I've been integrating a website with WebSSO,
> covering first ADFS, then Okta, and now I'm testing against
> Shibboleth. I've been using the CentOS pre-configued VirtualBox IdP
> image provided by IDM to test against, and I had some obstacles at
> first that I needed to work through, among those a missing validUntil
> attribute on my SP's federation metadata.
>
> I initially set it to a day, thinking that seemed alright, but got
> errors from Shibboleth that it was longer than what was allowed. I
> don't remember what the exact allowance was, but I then set it to an
> hour instead, and Shibboleth was then happy for all of Friday while I
> was testing.
>
> Weird thing is, this morning after the weekend, I open up my laptop,
> and I now see that Shibboleth is erroring out in its log, saying,
>
> Error filtering metadata from
> https://browsertest.localhost/login/sso/metadata.xml
> org.opensaml.saml2.metadata.provider.FilterException: Metadata's
> validity interval, 237588141ms, is larger than is allowed, 86400000ms.
>
> So now the allowed interval is 24 minutes? I haven't configured
> anything other than filters and resolvers, and haven't touched the
> machine during the weekend, so I'm a bit puzzled here. I can't find
> anyone on Google with questions regarding these 86400000ms, so it
> looks like I might be alone with this config...
>
> Is 24 minutes really the default? I've seen Google results hinting at
> a default max of 70 days...
>
> TIA,
> Daniel
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net