Overcome SLO problem by setting session lifetime of service to minimum

[Misc]

Hi,

i am quite new to shibboleth so it is a bit hard to always find the right
way getting things done and furthermore to evaluate ideas...
 We have several services configured so participate in Shibboleth SSO. One
of the well-known problems to SLO is that a participating service most
likely has some kind of session management itself. We probably need a quick
solution to this and my idea was as follows:

-protect / in Apache vhost config by Shibboleth
-set the services Session lifetime to minimum (let's say 1 min)
-turn services session auto-extend features off eventually
-realize logout by destroying the idp's cookie _idp_session

Most likely this strategy has the following impacts:

1. lot of additional network traffic because every request to any page will
result in the sp asking the idp if there is a valid shib session
2. additional performance impact by the idp's application server itself
which has to answer lots of requests
3. yes i am aware this is not SLO as we and many others would like to have
(immediate and reliable logoff from all services), but for us this probably
will fit our needs until we have patched all the services session management
code or something

So, what do you think about this idea? Did i forget anything of more or less
importance (most likely ;) )? Are there other impacts we have to be aware
of? What do you expect from impact 1. and 2. - are these blockers?

In the initial phase i would say we are talking about 100-200 requests more
or less in parallel to a shib-protected service. Loading additional
webressources like images or css might be multiplicators i guess. On the
other hand this describes peak times which will only occur several times a
day. 

Thanks for reading and regards,

Michael






--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Overcome-SLO-problem-by-setting-session-lifetime-of-service-to-minimum-tp7588853.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.