Does hitting /Shibboleth.sso/Session refresh the inactivity timeout?

[Brian Reindel]

Thanks Scott. I would like it if possible to let Shibboleth handle
inactivity just because we're letting it manage all of our other
session related activity and processing. However we have considered
disabling it and then letting the client handle the inactivity piece
and log the user out when necessary.

On Fri, Nov 8, 2013 at 11:03 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 11/8/13, 10:31 AM, "Brian Reindel" <brian at reindel.com> wrote:
>
>>We have a thick client protected under the context /client. It hits a
>>set of services that live unprotected at /services. Because
>>technically it isn't making requests to /client, but is active,
>>Shibboleth thinks the inactivity timeout has passed.
>
> Why not just disable the timeout? Set it to zero.
>
>> So we're
>>discussing how to address this, and one thought involves periodically
>>hitting /client/Shibboleth.sso/Session because it would tell us if the
>>session is active and would refresh the inactivity. However, this
>>isn't technically a protected endpoint, so I'm not sure it would
>>actually refresh the inactivity timeout. Can anyone tell me if this is
>>the case?
>
> It does, yes.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net