RequiredValidUntilFilter
Namespace: urn:mace:shibboleth:2.0:metadata
Schema: http://shibboleth.net/schema/idp/shibboleth-metadata.xsd
Overview
The root <md:EntitiesDescriptor>
element of a remotely obtained metadata file should be decorated with a validUntil
XML attribute. Before the metadata is loaded, the expiration date is checked. If the validUntil
attribute indicates the metadata is expired, the metadata is discarded.
The validity check described in the previous paragraph is always performed, regardless of the filters applied to the metadata. In addition to this basic validity check, the RequiredValidUntil
filter is used to detect metadata that never expires or has too long a validity period, both of which undermine the usual trust model supported by Shibboleth, and the only one actually standardized in SAML.
In particular, the RequiredValidUntil
filter refuses to load the metadata if either of the following conditions is true:
The root XML element does not contain a
validUntil
attribute.The value of the
validUntil
attribute is too far into the future as specified by themaxValidityInterval
attribute.
Metadata expiry is important!
In practice, a SignatureValidationFilter filter and a RequiredValidUntil
filter are often used together to securely obtain remote metadata via HTTP. See the FileBackedHTTPMetadataProvider and DynamicHTTPMetadataProvider topics for explicit configuration examples. Other distribution models are discussed in the TrustManagement topic.