SP Startup takes 20+ minutes

[Tom Scavo]

On Mon, May 2, 2016 at 8:50 AM, Scott Koranda <skoranda at gmail.com> wrote:
>> On Fri, Apr 29, 2016 at 8:54 PM, Scott Koranda <skoranda at gmail.com> wrote:
>>
>> Scott, you already know this but you lose HTTP Conditional GET with
>
> Sorry, I do not understand. There is no GET with this approach
> so I do not see how I lose Conditional Get.

Earlier in the thread, you show how to use curl to GET the metadata.
So the cron job dictates when the file is refreshed regardless of
whether or not the file has changed. OTOH, Shibboleth (both SP and
IdP) will skip a refresh attempt if the file has not changed.

> I understand your concern.
>
> I think, however, you underestimate the number of deployments
> that have solved the issue by simply turning off all signature
> checking. Both SPs and IdPs.

I wouldn't be surprised if a lot of SPs were doing this now but I
would be surprised if I found out the same were true for IdP
deployments. May I ask what makes you think this is so?

> In my opinion a documented work around with a detailed
> explanation of caveats is better then the altenatives

Perhaps you're right but this is still cause for concern. The fact
that we're even having this discussion is cause for concern.

> until
> the operation of the SP and IdP changes (note the JIRA issue
> is already being updated for the SP, and perhaps the IdP,
> though I am not tracking that directly).

I'm aware of the SP issue but not the IdP issue. Can you provide a
pointer (or an explanation)?

Thanks,

Tom