IDP session timeout

[Wessel, Keith]

So, if I log in using a username/password login handler, I won't be prompted to log in again until the timeout for that login handler or the session timeout value is reached, whichever happens first, and regardless of which other SPs I log into using whatever login handler they're using.

That run-on sentence true?

If so, I could theoretically use the login handler lifetime as a max lifetime if that's the only login handler I'm using, then use the session lifetime as an inactivity timeout since it gets reset on subsequent authentication requests from other SPs. If this is, for some reason, a ridiculous misuse of the configuration available to me, please explain before I shoot myself in the foot.

Thanks,
Keith


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, August 20, 2013 4:36 PM
To: Shib Users
Subject: Re: IDP session timeout

On 8/20/13 5:11 PM, "Wessel, Keith" <kwessel at illinois.edu> wrote:

>So, to confirm, Kevin, the session lifetime is an inactivity timer, but 
>the login handler timeout doesn't get reset and is a max session 
>lifetime. That correct?

The login handler value can't be "reset" because it only gets assigned when the handler runs, ergo when actual authentication happens. If that's not the meaning of the handler "running", then there is no way to reason about the system overall without knowing more about the specifics.

The IdP session has *nothing* to with security in the way you mean. It affects the ability to do Single Logout in theory, but as far as a "session" is concerned in the traditional sense of the term, it means nothing. What allows SSO is an active login method in the session, which has no timeout involved, it's a hard duration for each method/handler. The presence of a session alone has no capability to bypass a login. The timeout value is about resource cleanup, not security.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net