diff --git a/metadata.go b/metadata.go
index 2352278d..35eaf5e7 100644
--- a/metadata.go
+++ b/metadata.go
@@ -62,11 +62,13 @@ type EntityDescriptor struct {
 func (m *EntityDescriptor) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
 	type Alias EntityDescriptor
 	aux := &struct {
-		ValidUntil RelaxedTime `xml:"validUntil,attr,omitempty"`
+		ValidUntil    RelaxedTime `xml:"validUntil,attr,omitempty"`
+		CacheDuration Duration    `xml:"cacheDuration,attr,omitempty"`
 		*Alias
 	}{
-		ValidUntil: RelaxedTime(m.ValidUntil),
-		Alias:      (*Alias)(m),
+		ValidUntil:    RelaxedTime(m.ValidUntil),
+		CacheDuration: Duration(m.CacheDuration),
+		Alias:         (*Alias)(m),
 	}
 	return e.Encode(aux)
 }
@@ -75,7 +77,8 @@ func (m *EntityDescriptor) MarshalXML(e *xml.Encoder, start xml.StartElement) er
 func (m *EntityDescriptor) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error {
 	type Alias EntityDescriptor
 	aux := &struct {
-		ValidUntil RelaxedTime `xml:"validUntil,attr,omitempty"`
+		ValidUntil    RelaxedTime `xml:"validUntil,attr,omitempty"`
+		CacheDuration Duration    `xml:"cacheDuration,attr,omitempty"`
 		*Alias
 	}{
 		Alias: (*Alias)(m),
@@ -84,6 +87,7 @@ func (m *EntityDescriptor) UnmarshalXML(d *xml.Decoder, start xml.StartElement)
 		return err
 	}
 	m.ValidUntil = time.Time(aux.ValidUntil)
+	m.CacheDuration = time.Duration(aux.CacheDuration)
 	return nil
 }
 
diff --git a/metadata_test.go b/metadata_test.go
index a710fb22..9d1059b0 100644
--- a/metadata_test.go
+++ b/metadata_test.go
@@ -14,7 +14,7 @@ type MetadataTest struct{}
 var _ = Suite(&MetadataTest{})
 
 func (s *MetadataTest) TestCanParseMetadata(c *C) {
-	buf := []byte(`<?xml version='1.0' encoding='UTF-8'?><md:EntityDescriptor ID='_af805d1c-c2e3-444e-9cf5-efc664eeace6' entityID='https://dev.aa.kndr.org/users/auth/saml/metadata' xmlns:md='urn:oasis:names:tc:SAML:2.0:metadata' xmlns:saml='urn:oasis:names:tc:SAML:2.0:assertion'><md:SPSSODescriptor AuthnRequestsSigned='false' WantAssertionsSigned='false' protocolSupportEnumeration='urn:oasis:names:tc:SAML:2.0:protocol'><md:AssertionConsumerService Binding='urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' Location='https://dev.aa.kndr.org/users/auth/saml/callback' index='0' isDefault='true'/><md:AttributeConsumingService index='1' isDefault='true'><md:ServiceName xml:lang='en'>Required attributes</md:ServiceName><md:RequestedAttribute FriendlyName='Email address' Name='email' NameFormat='urn:oasis:names:tc:SAML:2.0:attrname-format:basic'/><md:RequestedAttribute FriendlyName='Full name' Name='name' NameFormat='urn:oasis:names:tc:SAML:2.0:attrname-format:basic'/><md:RequestedAttribute FriendlyName='Given name' Name='first_name' NameFormat='urn:oasis:names:tc:SAML:2.0:attrname-format:basic'/><md:RequestedAttribute FriendlyName='Family name' Name='last_name' NameFormat='urn:oasis:names:tc:SAML:2.0:attrname-format:basic'/></md:AttributeConsumingService></md:SPSSODescriptor></md:EntityDescriptor>`)
+	buf := []byte(`<?xml version='1.0' encoding='UTF-8'?><md:EntityDescriptor ID='_af805d1c-c2e3-444e-9cf5-efc664eeace6' entityID='https://dev.aa.kndr.org/users/auth/saml/metadata' validUntil='2001-02-03T04:05:06.789' cacheDuration='PT1H' xmlns:md='urn:oasis:names:tc:SAML:2.0:metadata' xmlns:saml='urn:oasis:names:tc:SAML:2.0:assertion'><md:SPSSODescriptor AuthnRequestsSigned='false' WantAssertionsSigned='false' protocolSupportEnumeration='urn:oasis:names:tc:SAML:2.0:protocol'><md:AssertionConsumerService Binding='urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' Location='https://dev.aa.kndr.org/users/auth/saml/callback' index='0' isDefault='true'/><md:AttributeConsumingService index='1' isDefault='true'><md:ServiceName xml:lang='en'>Required attributes</md:ServiceName><md:RequestedAttribute FriendlyName='Email address' Name='email' NameFormat='urn:oasis:names:tc:SAML:2.0:attrname-format:basic'/><md:RequestedAttribute FriendlyName='Full name' Name='name' NameFormat='urn:oasis:names:tc:SAML:2.0:attrname-format:basic'/><md:RequestedAttribute FriendlyName='Given name' Name='first_name' NameFormat='urn:oasis:names:tc:SAML:2.0:attrname-format:basic'/><md:RequestedAttribute FriendlyName='Family name' Name='last_name' NameFormat='urn:oasis:names:tc:SAML:2.0:attrname-format:basic'/></md:AttributeConsumingService></md:SPSSODescriptor></md:EntityDescriptor>`)
 
 	metadata := EntityDescriptor{}
 	err := xml.Unmarshal(buf, &metadata)
@@ -23,8 +23,10 @@ func (s *MetadataTest) TestCanParseMetadata(c *C) {
 	var False = false
 	var True = true
 	c.Assert(metadata, DeepEquals, EntityDescriptor{
-		EntityID: "https://dev.aa.kndr.org/users/auth/saml/metadata",
-		ID:       "_af805d1c-c2e3-444e-9cf5-efc664eeace6",
+		EntityID:      "https://dev.aa.kndr.org/users/auth/saml/metadata",
+		ID:            "_af805d1c-c2e3-444e-9cf5-efc664eeace6",
+		ValidUntil:    time.Date(2001, time.February, 3, 4, 5, 6, 789000000, time.UTC),
+		CacheDuration: time.Hour,
 		SPSSODescriptors: []SPSSODescriptor{
 			SPSSODescriptor{
 				XMLName: xml.Name{Space: "urn:oasis:names:tc:SAML:2.0:metadata", Local: "SPSSODescriptor"},
@@ -90,8 +92,9 @@ func (s *MetadataTest) TestCanProduceSPMetadata(c *C) {
 	AuthnRequestsSigned := true
 	WantAssertionsSigned := true
 	metadata := EntityDescriptor{
-		EntityID:   "http://localhost:5000/e087a985171710fb9fb30f30f41384f9/saml2/metadata/",
-		ValidUntil: validUntil,
+		EntityID:      "http://localhost:5000/e087a985171710fb9fb30f30f41384f9/saml2/metadata/",
+		ValidUntil:    validUntil,
+		CacheDuration: time.Hour,
 		SPSSODescriptors: []SPSSODescriptor{
 			SPSSODescriptor{
 				AuthnRequestsSigned:  &AuthnRequestsSigned,
@@ -149,7 +152,7 @@ cvCsEFiJZ4AbF+DgmO6TarJ8O05t8zvnOwJlNCASPZRH/JmF8tX0hoHuAQ==`,
 	buf, err := xml.MarshalIndent(metadata, "", "  ")
 	c.Assert(err, IsNil)
 	c.Assert(string(buf), Equals, ""+
-		"<EntityDescriptor xmlns=\"urn:oasis:names:tc:SAML:2.0:metadata\" entityID=\"http://localhost:5000/e087a985171710fb9fb30f30f41384f9/saml2/metadata/\" validUntil=\"2013-03-10T00:32:19.104Z\">\n"+
+		"<EntityDescriptor xmlns=\"urn:oasis:names:tc:SAML:2.0:metadata\" validUntil=\"2013-03-10T00:32:19.104Z\" cacheDuration=\"PT1H\" entityID=\"http://localhost:5000/e087a985171710fb9fb30f30f41384f9/saml2/metadata/\">\n"+
 		"  <SPSSODescriptor xmlns=\"urn:oasis:names:tc:SAML:2.0:metadata\" validUntil=\"0001-01-01T00:00:00Z\" protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\" AuthnRequestsSigned=\"true\" WantAssertionsSigned=\"true\">\n"+
 		"    <KeyDescriptor use=\"encryption\">\n"+
 		"      <KeyInfo xmlns=\"http://www.w3.org/2000/09/xmldsig#\">\n"+