<!DOCTYPE HTML><html>
<head>
<meta name="Generator" content="Amazon WorkMail v3.0-4289">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>6 Hour validUntil in IdP 3.4.0 Metadata Generator</title>
</head>
<body>
<p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">All,</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">Performing a fresh install of 3.4.0 appears to generate example metadata with a validUntil that is 6 hours from the instant of installation, e.g. validUntil="2018-10-27T20:25:54.617Z" from an install I just performed. I presume this is the implementation of:</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">https://issues.shibboleth.net/jira/browse/IDP-1118</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">I can understand putting in a default expiration of several months, which would give deployers time to learn how to manage and write metadata while still imposing a deadline for doing it, but 6 hours means the deployer needs to almost immediately understand and modify their metadata before even testing interoperability.</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">This is causing numerous Shibboleth IdP testers at SAMLtest.id to encounter failures due to metadata that is already expired by the time they upload it. I would rather not have to set requireValidMetadata to false.</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">Is there any chance of giving deployers a longer grace period?</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">Thanks,</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;">Nate.</p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p><p style="margin: 0px; font-family: Arial, Tahoma, Helvetica, sans-serif; font-size: small;"> </p>
</body>
</html>