expirationWarningThreshold

[Brent Putman]

On 5/19/17 10:14 AM, Tom Scavo wrote:
>
> What happens if there is no validUntil XML attribute on the root
> element? I would assume the expirationWarningThreshold setting is
> ignored in this case. Correct?

Yes, it is ignored.

Related: There are obvious caveats about this sort of thing wrt root
element validUntil, since of course one could have an aggregate
EntitiesDescriptor which itself doesn't contain a validUntil, but the
child Entity- and EntitiesDescriptors do.

So this new config param doesn't attempt to address those cases, only
the vast majority case of a root element validUntil.

>
> Would it make sense to treat expired metadata differently than
> metadata that exceeds the threshold (but is not expired)? If expired
> metadata is expunged from the system (which of course is the right
> thing to do), I would think this deserves serious consideration,
> perhaps an error message instead of a warning?

Well as far as logging an ERROR vs a WARN, our convention is to usually
only log an ERROR when there's something seriously wrong with the
system at a fundamental level.  Since this is really about "data", I'm
not sure that this qualifies.  But if the consensus of the other devs
is otherwise, it's certainly easy to change. The logging call for the
already-expired case is separate from the pending expiration cases.

We in fact do not actually literally expunge expired metadata, but we
don't return it from a metadata resolve call.  Each EntityDescriptor
candidate which is resolved is checked individually at runtime for
validity, and if invalid and isRequireValidMetadata==true, then it's
thrown out from the result set.

   

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20170519/8aba51cc/attachment.html>