SP session lifetime and influence of IdP

[Scott Koranda]

> On Fri, Feb 3, 2012 at 12:30, Scott Koranda <skoranda at gmail.com> wrote:
> > "For what it's worth, the 2.1 IdP has a way to control the
> > authentication duration and the SP session lifetime separately."
> > (Fri, 19 Sep 2008 13:54:11 +0200)
> >
> > How precisely does the IdP control/indicate to the SP the
> > session lifetime?
> 
> This would be another case of the docs being out of date, I'll fix
> that after I respond here.  In the SAML 2 SSO profile configuration
> you can set the maximumSPSessionLifetime attribute.  That is then used
> to populate the SessionNotOnOrAfter attribute in the authentication
> statement returned to the SP.
> 
> That'll be documented here:
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPSAML2SSOProfileConfig

Thank you.

Am I correct that without maximumSPSessionLifetime defined in
the profile configuration no SessionNotOnOrAfter attribute is
sent to the SP and hence the IdP does not in that
configuration control/indicate the SP session lifetime?

Thanks,

Scott K