idpv3: clustering and sealer key update

[Jarno Huuskonen]

Hi,

Is idp.sealer.updateInterval property how often idp checks if the
datasealer keys have changed on disk ?

Does the datasealer read new key from disk even if
idp.sealer.updateInterval hasn't happened yet:
Example: (idp.sealer.updateInterval=PT15M):
- 1: server1 updates sealer key(from v100 -> v101) and copies the files
  to server2
- 2: server1 runs updateInterval and picks up updated key (for example
  v101) and starts encrypting new cookies with new key
- 3: server2 runs updateInterval 14M after server1

-> if client (for example load balancer idletimout=5M) moves from server1 to
server2 between steps 2-3 does server2 read new key v101 from disk or is
the client forced to reauthenticate ?

If the client is forced to reauthenticate then I think
idp.sealer.updateInterval should be run every few minutes and
loadbalancer should persist clients to same server longer than
idp.sealer.updateInterval ?

How does idp.session.timeout correlate to how frequently you should
update sealer key ? Example:
idp.session.timeout=PT6H and you update sealer key every hour and
keep 3 keys. So clients cookie was created 5hours ago with key v100 and
now your're using v104 (and you'll have v104,v103,v102 in sealer store)   
--> clients cookie can't be decrypted (so session timeout is effectively
3H) ?

One more question: How do these(idp.session.timeout,
idp.authn.defaultLifetime and idp.authn.defaultTimeout) values control
how often client has to reauthenticate ?
(Are the the authn.default* values: maximum lifetime and inactivity
timeout describe in:
https://wiki.shibboleth.net/confluence/display/IDP30/Authentication
)
So for example:
idp.session.timeout=PT1H and idp.authn.defaultLifetime=PT2H
user needs to reauthenticate every 1 hour ?

And idp.session.timeout=PT4H, idp.authn.defaultLifetime=PT3H and
idp.authn.defaultTimeout=PT30M then if user is active(<30M) they
don't need to reauth. in 3H ? 

-Jarno

-- 
Jarno Huuskonen