Upped memory guidance

[Tim McLaughlin]

Responses inline below.  TL;DR: looks good, thank you for the confirmation and information.


Tim

On 16-02-22, 14:18, "users on behalf of Tom Scavo" <users-bounces at shibboleth.net on behalf of trscavo at gmail.com> wrote:

>On Mon, Feb 22, 2016 at 4:16 PM, Tim McLaughlin <Tim.McLaughlin at wwu.edu> wrote:
>> This is regarding Shibboleth IdP 2.4.3.
>>
>> I received the [ACTION REQUIRED] email mentioned below, and have done the inspection and Logging.xml config change.
>> I can see that the metadata refresh process succeeds for the InCommon-metadata source.
>
>That's good news.
>
>> One question about the two-week validity period, just to be thorough: Is it two weeks from the "creationInstant" value?
>
>Yes. Each metadata file expires two weeks from the "creationInstant"
>value. You can confirm that by checking the value of
>md:EntitiesDescriptor/@validUntil.

Thanks for this -- I just checked it and the value looks right for 14 days.  Not that I don't trust, just that it's nice to know how to verify.

>> One of the lines in the DEBUG output implies that it will expire about an hour from when I restarted my (backup) Shibboleth server.
>
>Is your MetadataProvider configured to refresh metadata every hour? If
>so, that's where that message comes from, I think.

I just double-checked this in my relying-party.xml, and yes, the InCommon MetadataProvider has maxRefreshDelay of "PT1H".

>Btw, every hour is just fine, even recommended. Shibboleth is smart
>enough to know when the metadata file has actually changed on the
>server. (It's called HTTP Conditional GET.) Usually that's once per
>business day but it could be more often depending on circumstances.
>
>Worst-case scenario, suppose InCommon stopped signing metadata. The
>last metadata file your software fetched would get older and older.
>After two weeks, it would expire and your software would stop working.
>That's very different from 'cacheDuration," which apparently is set to
>one hour on your system.
>
>Tom

Thanks for the information; it is nice to be able to verify that things are working as expected.

Tim