<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class=""><div text="#000000" bgcolor="#FFFFFF" class=""><blockquote type="cite" cite="mid:9846A6064BD102419D06814DD0D78DE11EA6FB4B@CIO-TNC-D2MBX02.osuad.osu.edu" class=""><blockquote type="cite" class=""><pre wrap="" class="">up on the users list, but there's one thing I'm sure about: a metadata
provider configured to refresh federation metadata with
expirationWarningThreshold="PT24H" won't do anybody much good since a
deployer doesn't directly control the validUntil attribute on
federation metadata. </pre>
</blockquote>
</blockquote>
<br class="">
No, they don't control. But the point I was trying to make is that
this setting is not about what happens under normal conditions, but
rather under abnormal conditions. It's not something you can
compute *directly* from knowledge of how the metadata source
populates the validUntil (although that knowledge is obviously
relevant). Because the very use case is "what happens when all of
that breaks". So the most I can say is that it's how far in advance
of a potential problem do you want to be notified so you can do
something about it. If you think it would take greater than 24hrs
to get your metadata source or federation operator to fix things,
then maybe it is indeed greater than 24hrs.<br class="">
<br class=""></div></div></blockquote><br class=""></div><div>I'm not sure why you think setting this value to more than 24 hours wouldn't make sense. Take the InCommon metadata, for example. I know it has a valid period of 2 weeks, and I know that just about every business day that metadata changes, and should be (if I have recommended refresh settings) therefore refreshed about once a business day. So if see that the validUntil of my copy is less than a week, then something is going wrong. it doesn't take getting to within 24 hours or less of it expiring to know I have a problem and things aren't working as I'd expect.</div><br class=""><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">--<br class="">Michael A. Grady<br class="">IAM Architect, Unicon, Inc.</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><br class="Apple-interchange-newline">
</div>
<br class=""></body></html>