expirationWarningThreshold

[Tom Scavo]

On Fri, May 19, 2017 at 4:11 PM, Brent Putman <putmanb at georgetown.edu> wrote:
>
> On 5/19/17 10:14 AM, Tom Scavo wrote:
>>
>> What happens if there is no validUntil XML attribute on the root
>> element? I would assume the expirationWarningThreshold setting is
>> ignored in this case. Correct?
>
> Yes, it is ignored.
>
> Related: There are obvious caveats about this sort of thing wrt root element
> validUntil, since of course one could have an aggregate EntitiesDescriptor
> which itself doesn't contain a validUntil, but the child Entity- and
> EntitiesDescriptors do.
>
> So this new config param doesn't attempt to address those cases, only the
> vast majority case of a root element validUntil.

Thanks for clarifying. All of that makes sense. It needs to be
documented, however.

>> Would it make sense to treat expired metadata differently than
>> metadata that exceeds the threshold (but is not expired)? If expired
>> metadata is expunged from the system (which of course is the right
>> thing to do), I would think this deserves serious consideration,
>> perhaps an error message instead of a warning?
>
> Well as far as logging an ERROR vs a WARN, our convention is to usually only
> log an ERROR when there's something seriously wrong with the system at a
> fundamental level.  Since this is really about "data", I'm not sure that
> this qualifies.  But if the consensus of the other devs is otherwise, it's
> certainly easy to change. The logging call for the already-expired case is
> separate from the pending expiration cases.

Okay, let's see what others think about this.

> We in fact do not actually literally expunge expired metadata, but we don't
> return it from a metadata resolve call.

This is not made clear in all the documentation I've read. Of course I
could have missed something.

> Each EntityDescriptor candidate
> which is resolved is checked individually at runtime for validity, and if
> invalid and isRequireValidMetadata==true, then it's thrown out from the
> result set.

That, too, is not clear by reading the documentation. I was under the
impression that invalid metadata was ignored, full stop. Also, what is
isRequireValidMetadata? I can't find that in the docs.

Thanks,

Tom