From e1d9c0694fb6eb421207901a0f772b4d4e6cc7af Mon Sep 17 00:00:00 2001
From: Paul Caskey <pcaskey@internet2.edu>
Date: Thu, 12 Oct 2023 10:10:06 -0500
Subject: [PATCH] add InCommon MDQ

---
 conf/metadata-providers.xml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/conf/metadata-providers.xml b/conf/metadata-providers.xml
index d5cb34b..d922a97 100644
--- a/conf/metadata-providers.xml
+++ b/conf/metadata-providers.xml
@@ -86,4 +86,18 @@
                       indexesRef="shibboleth.CASMetadataIndices" />
     -->
 
+    <!-- InCommon Per-Entity Metadata Distribution Service -->
+    <MetadataProvider id="incommon" xsi:type="DynamicHTTPMetadataProvider"
+                  maxCacheDuration="PT24H" minCacheDuration="PT10M">
+      <!-- Verify the signature on the root element (i.e., the EntityDescriptor element) -->
+      <MetadataFilter xsi:type="SignatureValidation" requireSignedRoot="true"
+                  certificateFile="%{idp.home}/credentials/inc-md-cert-mdq.pem" />
+  
+      <!-- Require a validUntil XML attribute no more than 14 days into the future -->
+      <MetadataFilter xsi:type="RequiredValidUntil" maxValidityInterval="P14D" />
+  
+      <!-- The MetadataQueryProtocol element specifies the base URL for the query protocol -->
+      <MetadataQueryProtocol>https://mdq.incommon.org/</MetadataQueryProtocol>
+    </MetadataProvider>
+    
 </MetadataProvider>