Metadata validity interval of 24 minutes?

[Søren Grønning]

Has your VM been running all along or has the state simply been saved in
the meantime? This could very well cause time and date issues with your
VM...

And yes, it's a small world, my friend ;-)
On Oct 12, 2015 10:31, "Daniel Smedegaard Buus" <danielbuus at gmail.com>
wrote:

> LOL, hi Søren :D Funny finding you here :) How's it going?
>
> Well, it's pretty strange — I have the SP configured as a relying
> party on the IdP with a MatadataProvider.maxValidityInterval="P1D", so
> it should be one day...
>
> Restarting tomcat on that machine made Shibboleth error out
> immediately on starting with the same error while loading the
> metadata. I then set it to P1M, and it works fine again.
>
> In fact, the only change since Friday, is that more than 1 day has
> passed, so I guess something's amiss there. The SP fetadata is
> generated on each request, and the http cache headers are set to 1
> hour.
>
> I do note upon Googling, that some related bugs were fixed in 2.4, and
> this IDM virtual machine is running 2.3.3.
>
> I'm really just testing against it, and I'm gonna kill it eventually,
> so I guess I'l just have to make a client requirement of anyone using
> Shibboleth to be fully upgraded and knowledgable about how to use it
> (more than I am, anyway ;) )
>
> Does this sound like something 2.3.3 might have probs with to you?
>
> Cheers,
> Daniel :)
>
> On Mon, Oct 12, 2015 at 10:16 AM, Søren Grønning <s.groening at gmail.com>
> wrote:
> > Hi Daniel
> >
> > What is your 'valid until' metadata value set to on both IdP and SP?
> >
> > It would seem to be a conflict between the two values that causes the
> error.
> >
> > It seems similar to this occurrence :
> >
> >
> https://lists.internet2.edu/sympa/arc/shibboleth-users/2008-11/msg00343.html
> >
> > Best regards,
> >
> > Søren Grønning
> >
> > On Oct 12, 2015 10:02, "Daniel Smedegaard Buus" <danielbuus at gmail.com>
> > wrote:
> >
> > Hey everyone :)
> >
> > I'm new to Shibboleth. I've been integrating a website with WebSSO,
> > covering first ADFS, then Okta, and now I'm testing against
> > Shibboleth. I've been using the CentOS pre-configued VirtualBox IdP
> > image provided by IDM to test against, and I had some obstacles at
> > first that I needed to work through, among those a missing validUntil
> > attribute on my SP's federation metadata.
> >
> > I initially set it to a day, thinking that seemed alright, but got
> > errors from Shibboleth that it was longer than what was allowed. I
> > don't remember what the exact allowance was, but I then set it to an
> > hour instead, and Shibboleth was then happy for all of Friday while I
> > was testing.
> >
> > Weird thing is, this morning after the weekend, I open up my laptop,
> > and I now see that Shibboleth is erroring out in its log, saying,
> >
> > Error filtering metadata from
> > https://browsertest.localhost/login/sso/metadata.xml
> > org.opensaml.saml2.metadata.provider.FilterException: Metadata's
> > validity interval, 237588141ms, is larger than is allowed, 86400000ms.
> >
> > So now the allowed interval is 24 minutes? I haven't configured
> > anything other than filters and resolvers, and haven't touched the
> > machine during the weekend, so I'm a bit puzzled here. I can't find
> > anyone on Google with questions regarding these 86400000ms, so it
> > looks like I might be alone with this config...
> >
> > Is 24 minutes really the default? I've seen Google results hinting at
> > a default max of 70 days...
> >
> > TIA,
> > Daniel
> > --
> > To unsubscribe from this list send an email to
> > users-unsubscribe at shibboleth.net
> >
> >
> > --
> > To unsubscribe from this list send an email to
> > users-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151012/3a652d9d/attachment.html>