<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 5/21/17 11:20 AM, Tom Scavo wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAEtu=dOud-X8_hpUYxo1_ABBXP=bC_m6erkczzQfk87X+yTxWQ@mail.gmail.com">
<pre wrap="">Okay, now I'm more confused. If the requireValidMetadata attribute is
about *usage* of cached metadata, that's news to me.</pre>
</blockquote>
<br>
Well, it's been there for over a decade, and this code hasn't
fundamentally changed in all that time.<br>
<br>
<br>
<blockquote type="cite"
cite="mid:CAEtu=dOud-X8_hpUYxo1_ABBXP=bC_m6erkczzQfk87X+yTxWQ@mail.gmail.com">
<pre wrap="">
In any case, I edited the text for requireValidMetadata so that it
corresponds to my understanding (which is probably wrong). Please
review and edit as necessary.
</pre>
</blockquote>
<br>
The edits aren't correct. The requireValidMetadata is not just
about the validUntil on the root element. 1) You're forgetting that
more than the root element can carry validUntil. When processing a
candidate EntityDescriptor, that element's validUntil as well as all
ancestor element validUntils are checked. 2) Strictly speaking, in
a software sense, this is about descriptor element validity more
generally, as the original docs noted. That could be about more
than validUntil checks (although currently that is all that is
checked, as was originally noted in the docs). I'll revert the docs
back, with a little bit of rewording to make more clear.<br>
<br>
FYI, in terms of symmetry, there is a similar config flag and logic
on the RoleDescriptorResolver impl. Remember that RoleDescriptor
can carry validUntil as well.<br>
<br>
<br>
<blockquote type="cite"
cite="mid:CAEtu=dOud-X8_hpUYxo1_ABBXP=bC_m6erkczzQfk87X+yTxWQ@mail.gmail.com">
<pre wrap="">
If we were starting from scratch, would it make sense to expose the
latter two configurations only? AFAICT, the first one isn't really an
option. I claim an implementation doesn't have the option of ignoring
the validUntil attribute. Do you agree?
</pre>
</blockquote>
<br>
Like Scott, I disagree. Aside from other low-level software use
cases where you might really want to process "invalid" metadata,
there's also the case of a broken metadata source that's taking
awhile to get fixed. If you're an IdP and you have to tell your
users that they absolutely can't use some service because of some
stale/expired metadata, due to hardcoded and un-changeable software
behaviour, then that might be bad. This flag puts that decision
into the hands of the IdP deployer. If they are OK with temporarily
disabling that check while the situation with the metadata source
gets sorted out, then that ought to be their decision.<br>
<br>
<br>
</body>
</html>