persistence of user consent

[David Langenberg]

So, it sounds like a good "sane" default would be keeping 7-14 keys or
slowing down the rotation?  Taking a 3-day weekend or something like
Thanksgiving shouldn't cause the user to have to re-approve?  So which is
the better approach, slowing down rotation or keeping a ton of keys loaded?

Dave

On Thu, Feb 19, 2015 at 8:47 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 2/19/15, 3:34 PM, "Ian Young" <ian at iay.org.uk> wrote:
>
>
>
> >I'm seeing the user consent dialog rather more often on my upgraded V3
> >IdP than I had expected. Is this likely to turn out to be related to the
> >frequency of secret key rollover (I'm doing that daily)?
>
> Probably. The defaults probably need tweaking, because keeping only three
> keys but changing them daily obviously won't work too well, but that said,
> the whole blob of data gets re-sealed with the latest key every time it
> has to change a record, so it would take 3-4 days with no activity for
> that to be the cause.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
David Langenberg
Identity & Access Management
The University of Chicago
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150219/0f58ac64/attachment-0001.html