expirationWarningThreshold

[Brent Putman]

On 5/16/17 3:07 PM, Cantor, Scott wrote:

>> At this point, I'm not entirely sure what advice to give if this comes
>> up on the users list, but there's one thing I'm sure about: a metadata
>> provider configured to refresh federation metadata with
>> expirationWarningThreshold="PT24H" won't do anybody much good since a
>> deployer doesn't directly control the validUntil attribute on
>> federation metadata. 

No, they don't control. But the point I was trying to make is that this
setting is not about what happens under normal conditions, but rather
under abnormal conditions.  It's not something you can compute
*directly* from knowledge of how the metadata source populates the
validUntil (although that knowledge is obviously relevant).  Because the
very use case is "what happens when all of that breaks".  So the most I
can say is that it's how far in advance of a potential problem do you
want to be notified so you can do something about it.  If you think it
would take greater than 24hrs to get your metadata source or federation
operator to fix things, then maybe it is indeed greater than 24hrs.


>> Once a warning is issued, the metadata will
>> certainly be rejected by the software in 24 hrs unless the federation
>> operator intervenes. 

Well to be clear, it's worse than that.  It might expire in 1 minute. 
Or it might expire in 23 hrs 59 mins.  All you are doing is setting the
threshold (window) within which you would want to be notified.  So it
also sort of matters how frequently your refresh cycle runs.


>> So it seems to me a deployer will want to know
>> well enough ahead of time (or not at all) so that the federation
>> operator can be alerted.

Yes.  Which is why it's difficult to give precise guidance on what the
value should be.  It's very dependent on a bunch of interrelated factors.

> Yes, s/federation operator/metadata source
>
> There's no default value with any meaning, the value is dependent on the metadata source and what you're going to do if it barks. It isn't deriveable from any other setting directly, though it's obviously related to the validity period.

Yes, exactly.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20170516/9121bf0d/attachment.html>