validUntil in IDP's metadata

[Tom Scavo]

On Tue, Feb 9, 2016 at 4:19 PM, Hong Ye <hy93 at cornell.edu> wrote:
>
> A new vendor I’m working with insisted that Cornell IDP’s metadata is
> incompatible with their default SP configuration because it doesn’t have a
> validUntil date in the meatadata. Our metadata is published in InCommon and
> is also available from:https://shibidp.cit.cornell.edu/idp/shibboleth. I
> think this metadata is auto generated by Shibboleth IDP.

You should never give out that URL to a SP partner. First, that
metadata is static and does not reflect your current configuration,
and second, it is not signed and (as you say) does not have an
expiration date, so that is a completely insecure way to share
metadata.

> I checked other
> IDP’s metadata in InCommon’s metadata, none if them have validUntil defined.

The root element of InCommon metadata most assuredly does have a
two-week validity interval. According to the metadata specification,
that expiration date applies to all child elements.

> Is it possible to configure IDP so it include validUntil in IDP’s metadata?
> We have IDP 2.4 now and will be upgraded to IDP 3 on March 6.

No. Tell your SP partner to refresh InCommon metadata daily, and be
sure to verify the XML signature and validate the expiration date at
each refresh. If they can't do that, you have a one-off on your hands.

Tom