SP session lifetime and influence of IdP

[Cantor, Scott]

> How precisely does the IdP control/indicate to the SP the
> session lifetime?

There's a SessionNotOnOrAfter attribute in the authn statement that the SP modifies the default session lifetime with if it's shorter than it would be.

> How precisely may I configure the Shibboleth IdP to
> control/indicate the SP session lifetime?

That I don't know offhand. The authn duration in the IdP isn't it, that's the IdP end only. My guess is it's in the SAML 2 SSO profile handler settings.

-- Scott