SAMLtest Updates

[Nate Klingenstein]

> Not if it has cacheDuration, but that really depends on the trust model. The IOP model, which is the only standard use of metadata there is, assumes a short term validUntil for reasons I've documented exhaustively. But generically, no.

True, understood, and concurring, but there are some implementations that are literally enforcing the MUST and not inferring anything about trust models in deployment, and this was breaking things for them.  Apparently they're presuming deployers are following their own trust model, which may or may not involve the IOP specification(located here for everyone's reference:).

https://docs.oasis-open.org/security/saml/Post2.0/sstc-metadata-iop-os.pdf

SAMLtest obviously has a unique "trust" model.  A very long cacheDuration in vacuo isn't semantically different from a very long validUntil in vacuo(in either case, you fetch a new copy when you feel like it, know a refresh is needed via an out-of-band mechanism, or you hit the timestamp).  Only in conjunction do they have any real distinction.

I don't know if whether a very long cacheDuration would resolve the problems for the people using these libraries.  It has been confirmed that a validUntil does.

I'd rather not force everyone to roll over their copy of SAMLtest's metadata periodically, as that would probably sting a far larger proportion of the user base.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id