Memory Usage

[Chad La Joie]

On Fri, Feb 3, 2012 at 12:59, Paul Hethmon
<paul.hethmon at clareitysecurity.com> wrote:
> The LoginContext is used during the actual login process, just the amount of
> time the user spends at the IdP prior to being authenticated. So the amount
> of time there looks to be an arbitrary value to allow a user to get
> distracted and still complete authentication. Also as an influence on it is
> the amount of time the SAML AuthnRequest is valid for. You want the user to
> complete authentication while that guy is still in the valid range. Once a
> user completes authentication, the LoginContext will be cleared since it is
> no longer needed/used.

Mostly correct.  The AuthnRequest rarely contains any temporal
bounding conditions and when it does, those are meant to apply to the
created authn statement.  They don't influence the authentication
process itself.

> The Replay Cache entry I would expect to live longer to prevent exactly that
> scenario, someone re-using the AuthnRequest, either maliciously or not. Most
> often is a user hitting refresh. I've also seen the problem where a browser
> will cache what should not be cached and resubmitting it. So you want that
> request to stick around in the replay cache until it would time out from the
> request expiring its life span.

Correct.  We don't document it, but you can actually go in and change
the amount of time data is kept in the replay cache via settings in
the internal.xml file.  Almost no one should adjust that.

-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered