Without specifing that the SAML medatada generated by omniauth-saml violate the SAML 2.0 specification because it doesn't include validUntil or cacheDuration attribute on the root EntityDescriptor element. It also doesn't provide an interface to define this by the application.
The specification is clear that it should be present at the root EntityDescriptor element.
When used as the root element of a metadata instance, this element MUST contain either a validUntil or cacheDuration attribute.
Both validUntil and cacheDuration of the EntityDescriptor element are optional in the specification because they should appear only on the root element and are not recommended to use elsewhere and the EntityDescriptor element doesn't have to be a root element.
It has been added in https://github.com/onelogin/ruby-saml/commit/92d6caf70e47f8e7218cb000b8fa9567eb2158cf (see https://github.com/onelogin/ruby-saml/issues/563).
Without specifing that the SAML medatada generated by omniauth-saml violate the SAML 2.0 specification because it doesn't include
validUntilorcacheDurationattribute on the rootEntityDescriptorelement. It also doesn't provide an interface to define this by the application.The specification is clear that it should be present at the root
EntityDescriptorelement.Both
validUntilandcacheDurationof theEntityDescriptorelement are optional in the specification because they should appear only on the root element and are not recommended to use elsewhere and theEntityDescriptorelement doesn't have to be a root element.Related issues:
CC @thorsteneckel