Metadata did not include a validUntil attribute

[Lipscomb, Gary]

Hi Scott,

Originally it was local, but I was trying the http download. Will revert back to local copy only.

Regards

Gary

> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor,
> Scott
> Sent: Tuesday, 7 November 2017 12:46
> To: Shib Users <users at shibboleth.net>
> Subject: Re: Metadata did not include a validUntil attribute
> 
> On 11/6/17, 8:37 PM, "users on behalf of Lipscomb, Gary" <users-
> bounces at shibboleth.net on behalf of glipscomb at csu.edu.au> wrote:
> 
> > I had downloaded it manually and loaded it in with our external vendor
> metadata.
> 
> I may have misread the stack trace as referencing an HTTP-based metadata
> source, not just local.
> 
> > All work well until the validUntil date arrived then no-one could access the
> site.
> 
> If it's locally loaded, then you should generally remove it, yes.
> 
> > I was looking at a way to overcome this without removing the validUntil
> attribute from the metadata.
> 
> That's impossible short of telling it to honor expired metadata, but that's silly,
> just remove it. If you remove validUntil, then you obviously have to stop
> using a filter that requires validUntil.
> 
> > The other issue then is how do I know if the SP has made changes to their
> metadata e.g. end points etc.
> 
> You don't, but loading it remotely won't help you if/when they change it
> improperly, and you definitely can't do that safely without additional
> measures to prevent contamination by an untrusted remote source. This has
> been covered within the last week in another thread.
> 
> -- Scott
> 
> 
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-
> unsubscribe at shibboleth.net