Is SP expiring user session prematurely?

[ragadeep sriperumbudur]

Hello,

Following is our environment
- Shibboleth-SP 2.5
- Apache 2.2

The client has an IdP that is sending the below <samlp:Response> as part of an IdP initiated SSO usecase

        <saml:Subject>
            <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">PRINCIPAL_NAME</saml:NameID>
            <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <saml:SubjectConfirmationData NotOnOrAfter="2013-03-20T12:01:14Z"
                                              Recipient="https://MyHost/Shibboleth.sso/SAML2/POST"/>
            </saml:SubjectConfirmation>
        </saml:Subject>
        <saml:Conditions NotBefore="2013-03-20T11:36:14Z" NotOnOrAfter="2013-03-20T12:01:14Z">
            <saml:AudienceRestriction>
                <saml:Audience>SampleAudienceName</saml:Audience>
            </saml:AudienceRestriction>
        </saml:Conditions>
        <saml:AuthnStatement AuthnInstant="2013-03-20T11:46:13Z" SessionIndex="id-123456789"
                             SessionNotOnOrAfter="2013-03-20T11:46:24Z">
            <saml:AuthnContext>
                <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos</saml:AuthnContextClassRef>
            </saml:AuthnContext>
        </saml:AuthnStatement>

What we are noticing is that the SP expires the session after a few minutes after authenticating the user. It follows the expected flow by trying to point to the location specified in the IdP's  metadata under Location attribute for md:SingleSignOnService element. We understand this is default behavior.

We understand various time restrictions in above message as below
-- saml:Conditions = Grant access to the user only in between the NotBefore and NotOnOrAfter time
-- saml:AuthnStatement = Create a session only between the AuthnInstant and SessionNotOnOrAfter

As we see in the logs, SP expires the session at 2013-03-20 11:54:20. If the session is being removed because the time period specified by IdP has passed we would expect it to do after 2013-03-20T12:01:14Z. Would appreciate if someone can point out why the SP expires before the expiry time set by the IdP? 

Following are the Application defaults for the SP

    <ApplicationDefaults entityID="MySPEntityID" REMOTE_USER="eppn">

        <Sessions lifetime="28800" timeout="3600" checkAddress="false" 
            handlerURL="/Shibboleth.sso" handlerSSL="true" cookieProps="https" relayState="ss:mem"
            exportLocation="http://localhost/Shibboleth.sso/GetAssertion" exportACL="127.0.0.1" >


Thanks
Ragadeep
 		 	   		  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130320/4e853a11/attachment.html