Metadata did not include a validUntil attribute

[Cantor, Scott]

On 11/6/17, 8:55 PM, "users on behalf of Lipscomb, Gary" <users-bounces at shibboleth.net on behalf of glipscomb at csu.edu.au> wrote:

> Originally it was local, but I was trying the http download. Will revert back to local copy only.

Ok. If you're going to do remote, you have to understand:

- you have no way of knowing if they'll change it ahead of time of making an actual change such that you'd gracefully adapt to the change (i.e. that they use it correctly)

- they're not signing it, and TLS means nothing or is the answer to all the world's security problems depending on your point of view

- you have to filter the metadata to prevent the injection of any other entity's metadata through that source; the IdP doesn't know that you only intend that one SP to be provisioned with it so that one source can potentially contain any number of SPs without you knowing it

Peter's suggestion of a cron job that downloads and compares it to notify you if it changes is a pretty nice compromise solution.

-- Scott