> You need to change the validUntil period to 21 days for now. Specifically the rule used in the RequireValidUntil filter applied to prevent stale metadata from being injected back into an IdP from a DNS or routing hijack. -- Scott