<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 5/13/17 8:26 PM, Tom Scavo wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAEtu=dPN+ko6pwOovFYtMd9uvUcuP0yczeYYYxohoxyxxV-oiQ@mail.gmail.com">
<pre wrap="">
What exactly is a "completed metadata refresh?" I assume that does not
include an attempted metadata refresh that was short-circuited via
HTTP Conditional GET, correct?
</pre>
</blockquote>
<br>
No, it includes literally every refresh cycle. The eval is done at
the end of the refresh() call, regardless of what did or did not
happen during the refresh.<br>
<br>
The issue is: <a class="moz-txt-link-freetext" href="https://issues.shibboleth.net/jira/browse/OSJ-200">https://issues.shibboleth.net/jira/browse/OSJ-200</a><br>
<br>
The main use case that prompted Scott to open the issue is precisely
what you mentioned above: No new metadata bytes were fetched b/c
they haven't changed - BUT the metadata is either expired or in
danger of expiring "soon". <br>
<br>
So now at the end of the refresh we check the live batch root
validUntil, and log a WARN on three cases:<br>
<br>
1) metadata is already expired or otherwise invalid<br>
2) it's going to expire within the configured
expirationWarningThreshold<br>
3) it's going to expire before the next scheduled refresh<br>
<br>
<br>
<blockquote type="cite"
cite="mid:CAEtu=dPN+ko6pwOovFYtMd9uvUcuP0yczeYYYxohoxyxxV-oiQ@mail.gmail.com">
<pre wrap="">
Presumably, an appropriate setting for expirationWarningThreshold will
depend on the values of the other configuration parameters. </pre>
</blockquote>
<br>
I suppose that's true, although I think you also need to factor in
knowledge about the "expected" validity duration of the metadata
source.<br>
<br>
<br>
<blockquote type="cite"
cite="mid:CAEtu=dPN+ko6pwOovFYtMd9uvUcuP0yczeYYYxohoxyxxV-oiQ@mail.gmail.com">
<pre wrap="">Suppose a
reloading metadata provider is configured to refresh metadata at least
daily. If validUntil is 14 days in the future, then the
expirationWarningThreshold should be set to PT13D, right?
</pre>
</blockquote>
<br>
I'm not sure about that. The point of the WARN log is to have
proactive notification of when something goes wrong. For example,
the metadata publisher's process stops working, or the publishing
endpoint stops responding, etc. So the "typical" validUntil isn't
really the main concern here.<br>
<br>
<br>
<blockquote type="cite"
cite="mid:CAEtu=dPN+ko6pwOovFYtMd9uvUcuP0yczeYYYxohoxyxxV-oiQ@mail.gmail.com">
<pre wrap="">
I'm probably not understanding something since the default value is
just PT12H.
</pre>
</blockquote>
<br>
As we discussed there at the end of the Jira issue, there's really
probably no good default, since it really depends on how often the
resolver refresh runs as well as what the typical validity duration
is.<br>
<br>
The value really is probably "How much time in advance of a
potential expired metadata situation do you want to see a WARN log,
so you can intervene and do something about it?"<br>
<br>
<br>
</body>
</html>