Andrew, Perhaps cache expiration is what you are looking for, https://apereo.github.io/cas/6.4.x/installation/Configuring-SAML2-DynamicMetadata.html This can also be defined on a per service basis, https://apereo.github.io/cas/6.4.x/services/SAML2-Service-Management.html
An MDQ service may be another option, https://apereo.github.io/cas/6.4.x/installation/Configuring-SAML2-DynamicMetadata-MDQ.html If you are using local files for your SP metadata, then you will have to stay on top of it. Ray On Mon, 2021-11-22 at 06:54 -0800, Andrew Marker wrote: Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information. I wonder if this is a needed area for improvement. Is that true? I'm sure I'm not the only one dealing with cert rotations not being automatic in CAS but it is widely mentioned with SPs that use short life certificates. On Friday, November 12, 2021 at 9:07:17 AM UTC-6 Andrew Marker wrote: Hi all, Is there a way to maintain the dynamic pull of the metadata and for a service or collectively for all SP MD files such that it does not fail when the certs are expired but an alternate cert is present? I think because of cert rotation, this is a situation that can occur. ---- I recently migrated our InCommon (IC) Federation to CAS and generally speaking it is working well. I have an IC vendor who has 2 keys (neither identified by use) and I had set up a service in CAS to dynamically pull the SP MD from InCommon. * One of the keys expired in 2013 * One key expires in the future CAS rejects the auth request when it finds the expired cert instead of skipping and finding the other cert. The only way I could get around this was to: * download a copy of the metadata * remove the expired cert * remove the life time attribute for the METADATA pushed by InCommon on the copy. * store it and reference the copy for use https://mdq.incommon.org/entities/https%3A%2F%2Fe5.onthehub.com Is there abetter way to maintain the dynamic pull of the metadata and for this service or collectively for all SP MD file not fail when the certs are expired? -- Ray Bon Programmer Analyst Development Services, University Systems 2507218831 | CLE 019 | [email protected]<mailto:[email protected]> I acknowledge and respect the lək̓ʷəŋən peoples on whose traditional territory the university stands, and the Songhees, Esquimalt and WSÁNEĆ peoples whose historical relationships with the land continue to this day. -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/21124c0057a015e8ba9aea66c0526621c1a78822.camel%40uvic.ca.
