Metadata validity interval of 24 minutes?

[Ian Young]

> On 12 Oct 2015, at 09:01, Daniel Smedegaard Buus <danielbuus at gmail.com> wrote:
> 
> Error filtering metadata from
> https://browsertest.localhost/login/sso/metadata.xml
> org.opensaml.saml2.metadata.provider.FilterException: Metadata's
> validity interval, 237588141ms, is larger than is allowed, 86400000ms.
> 
> So now the allowed interval is 24 minutes?

As Rod says, this is the result of your configuration, not a default in the code.

You have configured the maximum allowed validity interval to be one day (86400000ms = 86400s = 24*3600 seconds = 24 hours).

The validUntil of the metadata being analysed is more than one day in the future (237588141ms = 237588s = 66 hours = 2.75 days).

Specifying that the validity interval for metadata is only a day is an extremely aggressive setting. For comparison, most large federations use values in the range of a few days to several weeks. It's ultimately up to you, though, to choose values that make sense.

    -- Ian




-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20151012/7c586e3a/attachment-0001.p7s>