[JIRA] (IDP-1859) strange IDP SSO session

[Hong Ye (Jira)]

Hong Ye ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A00a92469-174a-4a39-aeba-4b46d2cb20be ) *created* an issue

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiMTRkYjVlM2RmM2YxNDdiN2I3YzI2YTI5ZmY3ZDU0ZjkiLCJwIjoiaiJ9 ) / Task ( https://shibboleth.atlassian.net/browse/IDP-1859?atlOrigin=eyJpIjoiMTRkYjVlM2RmM2YxNDdiN2I3YzI2YTI5ZmY3ZDU0ZjkiLCJwIjoiaiJ9 ) IDP-1859 ( https://shibboleth.atlassian.net/browse/IDP-1859?atlOrigin=eyJpIjoiMTRkYjVlM2RmM2YxNDdiN2I3YzI2YTI5ZmY3ZDU0ZjkiLCJwIjoiaiJ9 ) strange IDP SSO session ( https://shibboleth.atlassian.net/browse/IDP-1859?atlOrigin=eyJpIjoiMTRkYjVlM2RmM2YxNDdiN2I3YzI2YTI5ZmY3ZDU0ZjkiLCJwIjoiaiJ9 )

Issue Type: Task Affects Versions: 4.0.1 Assignee: Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) Components: Configuration Created: 26/Aug/21 9:00 PM Priority: Trivial Reporter: Hong Ye ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A00a92469-174a-4a39-aeba-4b46d2cb20be )

Hello,

In idp.properties, I have
idp.session.timeout = PT10H
idp.authn.defaultLifetime = PT10H
idp.authn.defaultTimeout = PT10H

With this setting, I think in the same browser, I just need to login to IDP once. then I'll have active IDP session for 10 hours. With active IDP session, I won't be prompted for login when accessing other websites as long as that site doesn't require forceAuth. I did some testing, I can't explain the behavior. Here is my test:
1. Accessed whoiam.cornell.edu which has shbboleth SP installed
2. Prompted for login at Cornell IDP. Logged in
3. whoiam.cornell.edu displayed to me.
4. Deleted shibSession cookie at whoiam.cornell.edu domain. Then refresh whoiam.cornell.edu. I wasn't prompted for login, SSO worked for me. Deleted shibSession cookie again, refresh whoiam.cornell.eud, I was prompted for login. I don't understand why the second time I was prompted for log in. Do I miss anything in IDP
configuration?
Here is IDP audit log:
2021-08-26T20:32:23.028-0400|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|https://www.whoiam.cornell.edu/shibboleth|http://shibboleth.net/ns/profiles/saml2/sso/browser|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|urn:oasis:names:tc:SAML:2.0:status:Success|||false|hy93|https://refeds.org/profile/mfa|
2021-08-26T20:32:59.698-0400|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|https://www.whoiam.cornell.edu/shibboleth|http://shibboleth.net/ns/profiles/saml2/sso/browser|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|urn:oasis:names:tc:SAML:2.0:status:Success|||true|hy93|https://refeds.org/profile/mfa|
2021-08-26T20:35:28.176-0400|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|https://www.whoiam.cornell.edu/shibboleth|http://shibboleth.net/ns/profiles/saml2/sso/browser|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|urn:oasis:names:tc:SAML:2.0:status:Success|||false|hy93|https://refeds.org/profile/mfa|

Thanks,
Hong

( https://shibboleth.atlassian.net/browse/IDP-1859#add-comment?atlOrigin=eyJpIjoiMTRkYjVlM2RmM2YxNDdiN2I3YzI2YTI5ZmY3ZDU0ZjkiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1859#add-comment?atlOrigin=eyJpIjoiMTRkYjVlM2RmM2YxNDdiN2I3YzI2YTI5ZmY3ZDU0ZjkiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100175- sha1:7b8572a )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20210827/9b025265/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-810f1d96-9a7e-487d-9145-992f5aab240c
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20210827/9b025265/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-f0a0e6eb-8a07-4e46-8ceb-6fb320e7d10a
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20210827/9b025265/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-5153a28e-800f-4139-94d1-8a96d47fc9bb
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20210827/9b025265/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-aab1934d-53d4-470e-b6ea-01abc946abf0
Type: image/png
Size: 468 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20210827/9b025265/attachment-0007.png>