<div dir="ltr">So, it sounds like a good "sane" default would be keeping 7-14 keys or slowing down the rotation? Taking a 3-day weekend or something like Thanksgiving shouldn't cause the user to have to re-approve? So which is the better approach, slowing down rotation or keeping a ton of keys loaded?<div><br></div><div>Dave</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Feb 19, 2015 at 8:47 AM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On 2/19/15, 3:34 PM, "Ian Young" <<a href="mailto:ian@iay.org.uk">ian@iay.org.uk</a>> wrote:<br>
<br>
<br>
<br>
>I'm seeing the user consent dialog rather more often on my upgraded V3<br>
>IdP than I had expected. Is this likely to turn out to be related to the<br>
>frequency of secret key rollover (I'm doing that daily)?<br>
<br>
</div></div>Probably. The defaults probably need tweaking, because keeping only three<br>
keys but changing them daily obviously won't work too well, but that said,<br>
the whole blob of data gets re-sealed with the latest key every time it<br>
has to change a record, so it would take 3-4 days with no activity for<br>
that to be the cause.<br>
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature">David Langenberg<div>Identity & Access Management</div><div>The University of Chicago</div></div>
</div>