Occasional problem with InCommon metadata refreshes

[Brian Koehmstedt]

On 6/26/2014 2:41 PM, Tom Scavo wrote:
> On Thu, Jun 26, 2014 at 5:15 PM, Brian Koehmstedt
> <bkoehmstedt at ucmerced.edu> wrote:
>> On 6/26/2014 2:00 PM, Tom Scavo wrote:
>>> What URL are you refreshing from? Are you verifying the signature on
>>> the metadata?
>>>
>> Refreshing from http://md.incommon.org/InCommon/InCommon-metadata.xml.
> That's good.
>
>> Am I verifying the signature?  No.  (Point taken that it's desirable to
>> do so.)
> More than desirable, it's a security issue, but I'll say no more...
>
>> Why am I using FilesystemMetadataProvider instead of
>> FileBackedHTTPMetadataProvider?
>>
>> Well, here's the deal:
>> I've discovered that sometimes service providers will update something
>> critical in the metadata and expect me to update immediately when they
>> do so (or when InCommon pushes it out).
> People are funny about that, aren't they? ;-)
>
>> If I set a 15 minute interval on FileBackedHTTPMetadataProvider, that's
>> downloading 10MB every 15 minutes.  Surely if all the IdPs did this,
>> you'd be not so happy with us.
> That's why most people use a smart metadata client (like Shibboleth)
> because it supports HTTP Conditional GET.
> (https://spaces.internet2.edu/x/44GVAQ)
>
>> But perhaps you encourage it after all.
>> (Here's my chance to find out!  What's your recommended interval?)
> It's documented on the Metadata Consumption page
> (https://spaces.internet2.edu/x/JwQjAQ) and the previously referenced
> Shibboleth Metadata Config page: one hour.
>
>> My intention was to be a good net citizen.
> That's appreciated but in this case your concern is unfounded.
>
>> I find that by using FilesystemMetadataProvider, if a service provider
>> demands we update metadata immediately, I can do so manually, then rely
>> on a 15 minute interval from FilesystemMetadataProvider to find the new
>> data in short order, without having to actually redownload 10MB from you
>> all throughout the day.
> None of that is necessary. Just configure your IdP as documented in
> the wiki and you should be good to go.
>
> Tom
>
Thanks Tom.  I was unaware of the Conditional GET support.  I'll switch 
to FileBackedHTTPMetadataProvider to see if that clears up this problem.