Questions about sealer key rotation

[Cantor, Scott]

> How often do you rotate the key and how many old keys do you keep? 

Daily, and I keep a month's worth.

> We are trying to find out the implication when an old key is no longer
> accessible. If we rotate the key daily and keep 30 old keys, what happens if
> someone has given consent to an SP but doesn't log in to that SP in a 30 day
> period?

Consent on the client is for toy/testing purposes anyway, that's not really something we would expect somebody to actually use.

Having said that, that is going to create a lot more trouble than most of the normal usage.

> Furthermore, if they log in to any shibboleth-protected SP, is that sufficient
> to ensure the consent for all SPs is not lost?

In general the data gets rewritten whenever the keys don't match but that's primarily true because it changes. With consent, if the records don't change, I would probably be less confident that it would be rewritten. I don't know offhand.

> Also when the sealer is rotated - does shibboleth automatically pick up the
> new key or we'll need to restart the shibboleth service?

Automatic, but the documentation should say that, I'll review it.

-- Scott