SAMLtest Updates

[Nate Klingenstein]

All,

A user of SAMLtest was kind enough to point out to me that a validUntil attribute is a MUST on the root element of metadata (333-335).

https://docs.oasis-open.org/security/saml/v2.0/saml-metadata-2.0-os.pdf

While clarifications have been made around the use of validUntil in the SAML errata, this requirement appears to still be in place.

https://docs.oasis-open.org/security/saml/v2.0/errata05/os/saml-v2.0-errata05-os.pdf

This has now been added.

I'll improve the error handling around cURL calls that timeout or otherwise fail so there are no endless spinning wheels when I get a chance to breathe.

The metadata still needs to be signed and will be soon.  There will be a signed copy and an unsigned copy available for each version; it's easy enough to delete the signature yourself for software in development that can't validate signatures, but I would rather create an extra file rather than an extra step for implementers.  The default metadata hosted at the entityID will be signed.

These changes will not affect your deployment unless you are dynamically pulling and refreshing metadata, and if your software can do that, it can presumably validate signatures and validity dates as well.  Existing metadata files that have no validUntil or are not signed will continue to work indefinitely.

Morty now sends two values for one attribute, and other users do not possess(and thus send) certain attributes.  These changes have been gradually rolled out over the last several months quietly.  This gives deployers a chance to validate handling of missing or multiple attributes.  I have not had time to document which attributes are available for each user, and it may even serve its intended purpose better this way.  I will add a note to that effect on the Download Metadata page.

It has not been upgraded to IdPv4 yet because I'm waiting on the release of IdPv4.1 and its demonstrated stable use in production.  There will likely be a complete rebuild of the server or container at that time as well, but that shouldn't take long.

SAMLtest just reached 30,000 providers.  As always, suggestions for improvement are encouraged, and it will remain a resource for the foreseeable future.  If you observe a tester who is flooding the logs through load testing or uptime checks, please inform me and I'll work with them to rectify the situation.

I want to thank you all for your usage of the service and I hope it has proved valuable for you.  It would not be as good as it is today were it not for your active input, so a special shout out to everyone who has made a suggestion over the years.

Best regards always,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id