expirationWarningThreshold

[Tom Scavo]

On Fri, May 19, 2017 at 4:37 PM, Brent Putman <putmanb at georgetown.edu> wrote:
>
> On 5/19/17 4:20 PM, Tom Scavo wrote:
>>
>> Thanks for clarifying. All of that makes sense. It needs to be
>> documented, however.
>
> I added a parenthetical qualifier to the expirationWarningThreshold docs on
> the wiki.

Thanks Brent. I modified the text yet again. Please review and edit accordingly.

> I don't know how one would document any of the other.  It's not about
> Shibboleth software, it's about general metadata concepts.

Not all SAML metadata concepts are well documented. The SAML metadata
spec says very little about validUntil. I don't recall if the
implementation profile we wrote says anything further about it.

> The necessity of the entity to
> be valid to be used is documented in the requireValidMetadata attribute.
>
>> That, too, is not clear by reading the documentation.
>
> It's in the requireValidMetadata attribute.

Okay, now I'm more confused. If the requireValidMetadata attribute is
about *usage* of cached metadata, that's news to me.

In any case, I edited the text for requireValidMetadata so that it
corresponds to my understanding (which is probably wrong). Please
review and edit as necessary.

>> Also, what is
>> isRequireValidMetadata? I can't find that in the docs.
>
> That's the Java method name, corresponds to the resolver config attribute
> requireValidMetadata:
>
> https://wiki.shibboleth.net/confluence/display/IDP30/MetadataConfiguration#MetadataConfiguration-Attributes
>
> It's been there since v2.2.

Yes, I see that now, thanks for reminding me, but I'm afraid this is
getting overly complicated. We now have:

1. MetadataProvider/@requireValidMetadata
2. MetadataProvider/@expirationWarningThreshold
3. MetadataProvider/MetadataFilter[@xsi:type="RequiredValidUntil"]

If we were starting from scratch, would it make sense to expose the
latter two configurations only? AFAICT, the first one isn't really an
option. I claim an implementation doesn't have the option of ignoring
the validUntil attribute. Do you agree?

Tom