Error with SPs registered with InCommon

[Michael Grady]

> On Feb 18, 2025, at 11:04 AM, Peter Schober via users <users at shibboleth.net> wrote:
> 
> The question those folks should be asking themselves is why their IDP
> stopped updating InCommon metadata two weeks ago.


Because the recommended setting -- recommended by InCommon -- for that RequiredValidUntil filter has always been 2 weeks (14 days). So just over 2 weeks ago, that InCommon aggregate started being published with a 3 week valid period, and that filter would have been rejecting that file now for 2 weeks. So the backup copy on disk finally expired since it last got refreshed by the Shib IdP.

The core problem is not using the aggregate per se, it is that the validUntil period changed without notification (at least I don't recall seeing any such). And that folks running the IdP are just assuming those refreshes are happening, because they have always done so in the past for them. They did not notice that their backup copy had not changed in over 2 weeks.

--
Michael A. Grady
IAM Architect, Unicon, Inc.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250218/b40f90e5/attachment.htm>