...
   <MetadataProvider type="XML" 
         url="http://www.aai.dfn.de/metadata/dfn-aai-edugain+idp-metadata.xml"
         validate="true" backingFilePath="dfn-aai-edugain+idp-metadata.xml" reloadInterval="3600">
      <MetadataFilter type="Signature" certificate="/etc/ssl/aai/dfn-aai.pem" verifyBackup="false" />
      <MetadataFilter type="Include" matcher="RegistrationAuthority">
         <registrationAuthority>http://rr.aai.switch.ch/</registrationAuthority>
         <registrationAuthority>http://eduid.at</registrationAuthority>
      </MetadataFilter>
   </MetadataProvider>
   ...