IDP session timeout

[Cantor, Scott]

On 8/20/13 5:11 PM, "Wessel, Keith" <kwessel at illinois.edu> wrote:

>So, to confirm, Kevin, the session lifetime is an inactivity timer, but
>the login handler timeout doesn't get reset and is a max session
>lifetime. That correct?

The login handler value can't be "reset" because it only gets assigned
when the handler runs, ergo when actual authentication happens. If that's
not the meaning of the handler "running", then there is no way to reason
about the system overall without knowing more about the specifics.

The IdP session has *nothing* to with security in the way you mean. It
affects the ability to do Single Logout in theory, but as far as a
"session" is concerned in the traditional sense of the term, it means
nothing. What allows SSO is an active login method in the session, which
has no timeout involved, it's a hard duration for each method/handler. The
presence of a session alone has no capability to bypass a login. The
timeout value is about resource cleanup, not security.

-- Scott