BookStack
BookStack copied to clipboard
Fix: Remove validUntil attribute from SAML SP Metadata
This PR disables the validUntil attribute in the generated SAML Service Provider (SP) metadata.
Why this is needed
Currently, the underlying php-saml library hardcodes the metadata validity (TIME_VALID) to 2 days and caching (TIME_CACHED) to 1 week (Source: Metadata.php).
In many real-world scenarios, specifically with Identity Providers like Shibboleth, these default windows are too short. This causes the IdP to deny connections or require manual metadata refreshes once the hardcoded time passes.
The getSPMetadata function in Settings.php allows for an $ignoreValidUntil parameter.
- I have updated the
getSPMetadatacall to set$ignoreValidUntiltotrue. - This removes the
validUntiltimestamp from the XML generated at<URL>/saml2/metadata, preventing arbitrary expiration issues.