Upped memory guidance

[Tom Scavo]

On Mon, Feb 22, 2016 at 4:16 PM, Tim McLaughlin <Tim.McLaughlin at wwu.edu> wrote:
> This is regarding Shibboleth IdP 2.4.3.
>
> I received the [ACTION REQUIRED] email mentioned below, and have done the inspection and Logging.xml config change.
> I can see that the metadata refresh process succeeds for the InCommon-metadata source.

That's good news.

> One question about the two-week validity period, just to be thorough: Is it two weeks from the "creationInstant" value?

Yes. Each metadata file expires two weeks from the "creationInstant"
value. You can confirm that by checking the value of
md:EntitiesDescriptor/@validUntil.

> One of the lines in the DEBUG output implies that it will expire about an hour from when I restarted my (backup) Shibboleth server.

Is your MetadataProvider configured to refresh metadata every hour? If
so, that's where that message comes from, I think.

Btw, every hour is just fine, even recommended. Shibboleth is smart
enough to know when the metadata file has actually changed on the
server. (It's called HTTP Conditional GET.) Usually that's once per
business day but it could be more often depending on circumstances.

Worst-case scenario, suppose InCommon stopped signing metadata. The
last metadata file your software fetched would get older and older.
After two weeks, it would expire and your software would stop working.
That's very different from 'cacheDuration," which apparently is set to
one hour on your system.

Tom