CryptoTransientId lifetimes

[Cantor, Scott]

On Aug 16, 2011, at 7:47 PM, "Tom Poage" <tfpoage at ucdavis.edu> wrote:

> Noticing a number of "No login context available" logs in my 2.3.3 IdP
> with CryptoTransientId. Not seen with earlier IdP versions, so I'm
> wondering if a timeout/lifetime might be an issue.

Using it for identifiers and queries has no impact on login or login context issues, they're totally separate functions.

> The example on the ResolverCryptoTransientIDAttributeDefinition page
> presents a lifetime of three minutes. Previously, I'd not specified any
> lifetime (i.e. default) with the regular transient ID. Source code
> (TransientIdAttributeDefinition.java) looks to reflect a default
> lifetime of four hours (1000 * 60 * 60 * 4 milliseconds).

The only need for a lengthy lifetime on them is for logout, which we don't support anyway. There's also a bug with the in-memory variant that means long lifetimes lead to improper reuse of the value across sessions.

-- Scott