SP session lifetime and influence of IdP

[Chad La Joie]

On Fri, Feb 3, 2012 at 12:30, Scott Koranda <skoranda at gmail.com> wrote:
> "For what it's worth, the 2.1 IdP has a way to control the
> authentication duration and the SP session lifetime separately."
> (Fri, 19 Sep 2008 13:54:11 +0200)
>
> How precisely does the IdP control/indicate to the SP the
> session lifetime?

This would be another case of the docs being out of date, I'll fix
that after I respond here.  In the SAML 2 SSO profile configuration
you can set the maximumSPSessionLifetime attribute.  That is then used
to populate the SessionNotOnOrAfter attribute in the authentication
statement returned to the SP.

That'll be documented here:
https://wiki.shibboleth.net/confluence/display/SHIB2/IdPSAML2SSOProfileConfig
-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered