Shibboleth Developers

Hello,

Our company is a service provider.
I am a developer who is facing a task of providing our users from multiple 
federations with shibboleth authentication. Tried to read as much as I could, 
but still have a few questions. 

It looks like we have to implement our own WAYF service. Is it correct?

I am planning to download federations metadata on a regular basis. 
Does once per day sound ok?
Do federations use common schema when publishing metadata? Where can I find 
xsd?

I am  planning to use cookie to keep a user state (federation, IdP location).
Are there any restrictions? good practices? what is suggested expiration time?

Thanks a lot

Svetlana Freytsis
EBSCO Publishing