My actual question is block-quoted below, but read on for context.
When you use AppRegNew.aspx to setup app credentials for provider-hosted apps the secret expires (by default) after 1 year. This means the app will stop working.
I've setup a fairly robust way to deal with this, by using a local store of app credential information and then having my apps pull the credentials from that store as needed, rather than "hard coding" the AppIds and Secrets into something like a web.config or app.config. It requests the credentials by app name from the store, and those credentials are automatically managed by a separate Windows service when expiration dates come up.
The issue I'm having is in determining when the new/updated secrets take effect. According to Microsoft it takes at least 24 hours. Changing it ahead of time and supporting "SecondarySecret" values within the TokenHelper implementation seems like the only solution here, which is what I've done. This still requires me to either leave the secondary secret active indefinitely, or just assume it's working after, say, 48 hours... or 1 week... or whatever, and then remove it automatically. Manually testing dozens of apps to ensure secret changes are working properly is a huge waste of time, especially given that it comes up every 3 years (max).
How are other people dealing with this secret expiration problem? It feels like a pretty poorly designed mechanism that is fundamental to how it actually works.
I suppose alternatively you could just create a new app every time the secret expires, and link that up with the provider-hosted solution. Maybe that's the better approach?
Is there something I'm missing here?