IDP session timeout

[Cantor, Scott]

On 8/20/13 5:44 PM, "Wessel, Keith" <kwessel at illinois.edu> wrote:

>So, if I log in using a username/password login handler, I won't be
>prompted to log in again until the timeout for that login handler or the
>session timeout value is reached, whichever happens first, and regardless
>of which other SPs I log into using whatever login handler they're using.

If there are multiple handlers, then you have to take into account
when/why they would run to answer that, but for one handler alone handling
everything, yes.

>If so, I could theoretically use the login handler lifetime as a max
>lifetime if that's the only login handler I'm using, then use the session
>lifetime as an inactivity timeout since it gets reset on subsequent
>authentication requests from other SPs. If this is, for some reason, a
>ridiculous misuse of the configuration available to me, please explain
>before I shoot myself in the foot.

I suppose that's true. I was thinking about the case where the timeout is
longer, but I guess if it's shorter that would be a limiting factor.

-- Scott