Metadata expiry and computing a new expiration time.

[Ian Young]

> On 14 Sep 2015, at 10:01, Simon Fraser <srf at sanger.ac.uk> wrote:
> 
> I've added the verification based on the example in the config file:

Not sure why that isn't working (and we should definitely try to get to the bottom of it) but the recommendation from the UKf web site is as follows:

http://www.ukfederation.org.uk/content/Documents/Setup3IdP#metadata

    <MetadataProvider id="UKfederationMetadata"
                      xsi:type="FileBackedHTTPMetadataProvider"
                      backingFile="%{idp.home}/metadata/ukfederation-metadata.xml"
                      metadataURL="http://metadata.ukfederation.org.uk/ukfederation-metadata.xml">

        <MetadataFilter xsi:type="ChainingFilter">
            <MetadataFilter xsi:type="SignatureValidation" requireSignedMetadata="true"
                            certificateFile="%{idp.home}/credentials/ukfederation.pem"/>
            <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P30D"/>
            <MetadataFilter xsi:type="SchemaValidation"/>
            <MetadataFilter xsi:type="EntityRoleWhiteList">
                <RetainedRole>md:SPSSODescriptor</RetainedRole>
            </MetadataFilter>
        </MetadataFilter>
    </MetadataProvider>

Can you try that as well and see if it works for you?

    -- Ian




-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5250 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20150914/1d8110f7/attachment.p7s>