SP timing out after 60 minutes.

[Ragadeep Sriperumbudur]

> So (a) the IDP wants to limit the length the session at your SP.
> And (b) it also wants to have longer sessions at your SP.
> To me "(a) AND (b)" sounds not entirely unlike contradiction.
> -peter

As per SAML spec, SessionNotOnOrAfter indicates the length of the user
session between Principal and IdP. The SP honors this value to expire the
session at the SP. In our case, the IdP wants to define a shorter session on
their end

In a way its contradicting, but I can see the need where the IdP would want
the user to authenticate each time before switching to an other application.
So take the below example

- IdP controls user authentication for users in a system that consists of
two applications. Application A guarded by SP1 and Application B guarded by
SP2
- User goes through an IdP initiated SSO, accesses App-A. After doing some
operations the user tries to access App-B
- The client wants the user to go through the process of authentication
(/let's assume Username/Pass authentication/) when the user switches from
App-A to App-B

Is there an alternative way to achieve the above without using
SessionNotOnOrAfter?



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/SP-timing-out-after-60-minutes-tp7584660p7585703.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.