SP timing out after 60 minutes.

[Cantor, Scott]

On 3/27/13 2:28 PM, "Ragadeep Sriperumbudur" <ragadeep99 at hotmail.com>
wrote:

>I understand each IdP is different, but for the sake of discussion - is
>there a way to define a shorter user session in the Shibboleth IdP and not
>send the /SessionNotOnOrAfter /attribute in the SAML response to the SP.

I'm saying that SessionNotOnOrAfter has *nothing* to do with the IdP's
session. For the Shibboleth IdP, the session for a login is based on the
authentication method duration. For a different IdP, I have no idea.

>We currently use Shibboleth Idp for internal testing of our SP and know
>about
>the /maximumSPSessionLifetime/property on the profile configuration to
>use.
>But that attribute directly controls the SessionNotOnOrAfter property in
>SAML response.

Yes, and has *nothing* to do with IdP session lifetime.

>Has anything changed since then? Does Shibboleth SP offer this now?

No.

>Our interpretation of the profile spec of the /AuthnStatement / and
>specifically in reference to the last part where the SP reestablishes the
>principal's identity would mean that the SP will have to create new
>sessions
>with the specified session expiry as long as the assertion from the IdP is
>valid.

It's a SHOULD, which means that as an implementer if you're not going to
provide an option, the obvious choice is to follow the advice, which I
did. Since it's not a MUST, it's not an unreasonable thing to provide an
option to override the behavior.

-- Scott