Overcome SLO problem by setting session lifetime of service to minimum

[Nate Klingenstein]

Michael,

> -set the services Session lifetime to minimum (let's say 1 min)
> -turn services session auto-extend features off eventually
> -realize logout by destroying the idp's cookie _idp_session
> 
> Most likely this strategy has the following impacts:
> 
> 1. lot of additional network traffic because every request to any page will
> result in the sp asking the idp if there is a valid shib session

This would also require a roundtrip by the client and generation and processing of an assertion.  I'm also not sure that it fixes anything because, as long as the IdP session remains, the user(or attacker) is effectively able to login again anyway.

> So, what do you think about this idea? Did i forget anything of more or less
> importance (most likely ;) )? Are there other impacts we have to be aware
> of? What do you expect from impact 1. and 2. - are these blockers?

I would consider them to be blockers, yes, most particularly from a user experience perspective.  You can throw additional hardware at performance issues, but not UX issues.

My preferred solution in a situation like this would be to tell the application to manage its own sessions and integrate the application's logout mechanism with the IdP(which is as easy as a redirect).  This just uses Shibboleth to protect the mechanism that creates the application session, so for the SP in that scenario, a short expiration(~5 minutes) is fine, and it leaves you with only one session to deal with.

Alternatively to short sessions, the application could be integrated with an SP logout mechanism that cascades the logout message to the IdP.  Destroying the session cookie at the IdP is one way to do this, and the recent IdP release supports mechanisms for that.

Hope this helps,
Nate.