Thanks Tom, some follow up questions then:<br><br>1) As you suggested, I read the SAML spec. In saml-metadata-2.0-os.pdf, when describing the <EntitiesDescriptor> and <EntityDescriptor> element, I found this sentense:<br>
When used as the root element of a metadata instance, this element MUST contain either a validUntil<br>or cacheDuration attribute.<br> Does it mean in the metadata, the root <EntityDescriptor> needs to include "validUntil"? Why you said it is optional? <br>
<br><br>2) If I want to use Shibboleth SP. How can I produce a production level metadata file? Do I need to manually edit it based on what ever Shib SP has generated?<br><br>Thanks,<br clear="all">Yaowen<br>
<br><br><div class="gmail_quote">On Wed, Oct 17, 2012 at 5:43 PM, Tom Scavo <span dir="ltr"><<a href="mailto:trscavo@gmail.com" target="_blank">trscavo@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im">On Wed, Oct 17, 2012 at 7:42 PM, Yaowen Tu <<a href="mailto:yaowen.tu@gmail.com">yaowen.tu@gmail.com</a>> wrote:<br>
> I don't see "validUntil" attribute in OOTB Shibboleth SP metadata. Several<br>
> question about this:<br>
><br>
> 1) In SAML, is it required to have "validUntil" attribute in production SP<br>
> server?<br>
<br>
</div>A SAML SP is not required to use SAML metadata. Likewise SAML metadata<br>
need not contain a validUntil attribute. You can (and should) verify<br>
these claims in the SAML specs.<br>
<div class="im"><br>
> 2) In Shibboleth SP, how to config it to include this attribute?<br>
> 3) Once the metadata expires, does the Shib SP automatically re-generate the<br>
> metadata or we need to restart the server?<br>
<br>
</div>How you produce metadata is out of scope with respect to the SP<br>
software. The Shibboleth SP produces some initial metadata for you,<br>
but that metadata is not intended to be used in a production setting.<br>
<div class="im"><br>
> 4) Suppose our SP re-generates the metadata, can we assume that IdP will<br>
> also update the SP metadata automatically?<br>
<br>
</div>I dearly wish that were true but unfortunately it doesn't work that<br>
way! In a distributed system, the SP has absolutely no control over<br>
IdP behavior. You should of course obtain assurances beforehand that<br>
the IdP will do the right thing, but this is part of the trust<br>
relationship between SP and IdP. You either trust your partner to do<br>
the right thing or you don't. If the IdP fails to do the right thing,<br>
you will suffer, surely.<br>
<br>
Sounds like a human relationship, right? That's federation for you :-)<br>
<br>
Tom<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br>