Skip to content

Conversation

@jdede
Copy link

@jdede jdede commented Nov 23, 2025

This PR disables the validUntil attribute in the generated SAML Service Provider (SP) metadata.

Why this is needed

Currently, the underlying php-saml library hardcodes the metadata validity (TIME_VALID) to 2 days and caching (TIME_CACHED) to 1 week (Source: Metadata.php).

In many real-world scenarios, specifically with Identity Providers like Shibboleth, these default windows are too short. This causes the IdP to deny connections or require manual metadata refreshes once the hardcoded time passes.

The getSPMetadata function in Settings.php allows for an $ignoreValidUntil parameter.

  • I have updated the getSPMetadata call to set $ignoreValidUntil to true.
  • This removes the validUntil timestamp from the XML generated at <URL>/saml2/metadata, preventing arbitrary expiration issues.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant