Namespace: urn:mace:shibboleth:2.0:metadata
Schema: http://shibboleth.net/schema/idp/shibboleth-metadata.xsd
Overview
The root <md:EntitiesDescriptor>
element of a remotely obtained metadata file should be decorated with a validUntil
XML attribute. Before the metadata is loaded, the expiration date is checked. If the validUntil
attribute indicates the metadata is expired, the metadata is discarded.
The validity check described in the previous paragraph is always performed, regardless of the filters applied to the metadata. In addition to this basic validity check, the RequiredValidUntil
filter is used to detect metadata that never expires or has too long a validity period, both of which undermine the usual trust model supported by Shibboleth. In particular, the RequiredValidUntil
filter refuses to load the metadata if either of the following conditions is true:
...
Note | ||
---|---|---|
| ||
In practice, a |
Schema
...
Reference
Attributes
Name | Type | Default | Description | ||
---|---|---|---|---|---|
maxValidityInterval | ISO 8601 duration | PT14D
| Defines the window within which the metadata is valid. A value of zero is a no-op and should be avoided. |
Warning |
---|
If a zero duration is specified, any value of validUntil will be accepted (which is probably not what you want). Omitting the maxValidityInterval setting has been adjusted to default to a 14 day window, as noted above. |
Child Elements
None
Example
Code Block | ||||
---|---|---|---|---|
| ||||
<!-- Require a validUntil XML attribute on the EntitiesDescriptor element and make sure its value is no more than 14 days into the future. --> <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P14D"/> |