requiring valid metadata

[Brent Putman]

On 3/30/16 9:40 AM, Tom Scavo wrote:
>>
>> They aren't related really. The filter is used to prevent loading metadata that never expires or has too long a validity period, which undermines the trust model.
>>
>> The attribute IIRC was there to prevent the IdP from loading metadata that was already invalid at the time it's loaded, I have no idea how it's used or if anybody ever touches it. The SP doesn't have that setting, and that's usually a good sign I didn't think it made sense.
> Thanks Scott. This seems pretty important. Maybe Rod could weigh in
> with an explanation?
>
>

I'm not Rod, but:  The 'requireValidMetadata' property is historical,
it's been there since the early 2.0 days (2006 it seems, according to
svn).  It essentially just determines whether the 'validUntil'
timestamp is even processed: To be "valid",  an Entity- or
EntitiesDescriptor and all its ancestor EntitiesDescriptors, must
either 1) have a 'validUntil' that is after the current "now" time or
2) must have no 'validUntil'.  (One of the purposes of the
RequiredValidUntilFilter is to enforce that the latter isn't the
case).  Setting 'requireValidMetadata' to false turns off this
'validUntil' processing.  It defaults to true, obviously.

I don't know if it's used much or what the original use case(s) were. 
I imagine it's for testing or any other situation where you know that
metadata is expired, but you want to say "I don't care, use it anyway". 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160330/6f2c06c3/attachment.html>