Metadata SP ValidUntil

[Marko Himmel]

Hello. I'm new to SAML. Can someone tell me how I can automate the metadata for the SP? So with the addition ValidUntil in the metadata. For example, renew every 7 days. Is there an example of this?

[Peter Schober]

* 'Marko Himmel' via SimpleSAMLphp <simple...@googlegroups.com> [2021-04-07 14:03]:

> Hello. I'm new to SAML. Can someone tell me how I can automate the metadata
> for the SP? So with the addition ValidUntil in the metadata. For example,
> renew every 7 days. Is there an example of this?

validUntil makes most sense with "sign & expire", cf. section 2.7 in
https://docs.oasis-open.org/security/saml/Post2.0/sstc-metadata-iop.html
(called "Repeatedly expiring (using a validUntil attribute) and
reissuing the metadata" there.)

Not sure doing that (either only expiring or signing with an untrusted
key & expiring regularly) makes sense for individual entities, though.

All of this depends on your trust model.

-peter