BookStack icon indicating copy to clipboard operation
BookStack copied to clipboard

Fix: Remove validUntil attribute from SAML SP Metadata

Open jdede opened this issue 1 month ago • 0 comments

This PR disables the validUntil attribute in the generated SAML Service Provider (SP) metadata.

Why this is needed

Currently, the underlying php-saml library hardcodes the metadata validity (TIME_VALID) to 2 days and caching (TIME_CACHED) to 1 week (Source: Metadata.php).

In many real-world scenarios, specifically with Identity Providers like Shibboleth, these default windows are too short. This causes the IdP to deny connections or require manual metadata refreshes once the hardcoded time passes.

The getSPMetadata function in Settings.php allows for an $ignoreValidUntil parameter.

  • I have updated the getSPMetadata call to set $ignoreValidUntil to true.
  • This removes the validUntil timestamp from the XML generated at <URL>/saml2/metadata, preventing arbitrary expiration issues.

jdede avatar Nov 23 '25 22:11 jdede