Versions Compared

Old Version 11

changes.mady.by.user trscavo@ncsa.illinois.edu

Saved on

compared with

New Version 12

changes.mady.by.user trscavo@ncsa.illinois.edu

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Tip
titleMonitor the log file in real time
Open two terminal windows. In one window, execute ‘tail -f $LOG_FILE’. In the other window, execute the above command. Adjust the LOG_LEVEL environment variable as needed. For example, to invoke DEBUG logging throughout, type ‘export LOG_LEVEL=4’ into the command window. Alternatively, apply the -D option to any (or all) of the metadata filters in the pipeline.


Try Yes the Shibboleth IdP ensures that the metadata is valid, and it will even warn you (optionally) if the metadata is soon-to-be-expired, but the IdP is not aware of the @creationInstant attribute and therefore it has no notion of a Freshness Interval. OTOH, the early warning system implemented above does all of the following:


  1. Requires the @validUntil attribute to exist and ensures its value is in the future but not too far into the future

  2. Requires the @creationInstant attribute to exist and ensures its value is in the past

  3. Warns if the metadata is soon-to-be-expired
  4. Warns if the metadata is stale (but not soon-to-be-expired)


The last step is the essence of the early warning system.

Now try the following experiments:

  1. Assuming the validity interval Validity Interval is in fact 14 days, set maxValidityInterval to something less and watch the process fail: an error message will be logged.

  2. Again assuming the validity interval is in fact actual Validity Interval is 14 days, set maxValidityInterval to something more and watch the process fail: a warning message will be logged.

  3. Set the freshnessInterval to some ridiculously small value (like PT60S) and watch the process fail: a warning message will be logged.

  4. Set the expirationWarningInterval to some ridiculously large value (relative to the actual Validity Interval) and watch the process fail: a warning message will be logged.

Once you've confirmed that the early warning system is behaving as expected, continue with the following configuration steps.

Persisting the Timestamps

...