Timeout or something?

[Nate Klingenstein]

There are many ways to do this.

1)  You could change the timeout behavior(if that's your desired policy); or
2)  You could change https://idp.example.org/idp/shibboleth in the SSO element to match the entityID of the IdP, the one you're using when you originally invoke a session; or
3)  You can also configure something in the Apache content protection (requireSessionWith).

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPContentSettings

If you intend to work with many IdP's in the future, then #1 or #3 are your better solutions.

On Jul 19, 2013, at 19:03 , Jason Gauthier wrote:

> That makes sense, and I see that in the XML.  But what should it be?  My Idp or the resource protected by shib?
> 
> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Nate Klingenstein
> Sent: Friday, July 19, 2013 1:16 PM
> To: Shib Users
> Subject: Re: Timeout or something?
> 
> SWAG:
> 
> It sounds like the SP is set to automatically protect a resource, and the session cookie for that resource is timing out.  The original invocation of Shibboleth included an entityID parameter of some sort somewhere.
> 
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessionCreationParameters
> 
> On session expiration(modulated by the Sessions element's "lifetime" and "timeout" timeouts)
> 
> https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions
> 
> your SP is trying to restablish a new session for that user, but it doesn't have the entityID parameter supplied to it and there's some default in place somewhere that goes to idp.example.org, probably in your SSO element in shibboleth2.xml.
> 
> On Jul 19, 2013, at 16:53 , Jason Gauthier wrote:
> 
>> Open a resource protected by shib, authentication occurs, everything works great.
>> When I leave the session unused for a period of time (unknown amount, but it has been around an hour) I come back and click a link I get the following:
>> 
>> opensaml::saml2md::MetadataException at (https://site.company.com/url) 
>> Unable to locate metadata for identity provider 
>> (https://idp.example.org/idp/shibboleth)
>> 
>> However, merely reloading the page, appears to execute another authenticate and then all is well.
>> Nothing is logged by Shib directly, but apache reports this:
>> opensaml::saml2md::MetadataException at (https://site.company.com/url) 
>> Unable to locate metadata for identity provider 
>> (https://idp.example.org/idp/shibboleth)
>> 
> 
>