First Response Dispatched by mod_shib Before Metadata Reloading Completes?

[Cantor, Scott]

On 9/4/12 1:38 PM, "Nate Klingenstein" <ndk at internet2.edu> wrote:

>I can make dynamic reloading "work" by having the metadata upload
>process touch /etc/shibboleth/shibboleth2.xml and then issue a curl
>command to a session initiator, triggering the refresh ahead of the
>first user attempt.  Any opinion on whether this is good, bad, or
>ugly, relative to having the metadata upload process forcibly reboot
>shibd?

It's fine, it's just not a guarantee of anything. If it takes 30 seconds
to finish reloading the configuration, then some number of requests can be
serviced before that finishes. Accessing the system will cause it to
signal the thread to reload, but there's no lock. The lock is how it used
to work and people didn't like that for good reason.

If you want guarantees, restarting during a maintenance window is the only
way to have that.

-- Scott