SP session time-out period, IDP session time-out period, <NotBefore> and <NotOnOrAfter>

[Peter Schober]

* Adam Dong <adamdong at vidder.com> [2014-12-03 01:45]:
> How is the SP local session time-out period decided ?

When the configured (or defaulted) number of seconds have passed
without the SP having seen a request from the browser.

> It has nothing to do with the <NotBefore> and <NotOnOrAfter> in the
> <Assertion>’s <SubjectConfirmationData> or <Condition>, right ?

Right, those are for acceptance of the assertion before a local
session is created.

> Furthermore, it has nothing to do with the IDP local session
> time-out period, right ?

Right. Though the IDP can put a maximum lifetime on the SP session by
including a SessionNotOnOrAfter as part of the AuthnStatement, IIRC.

These are all SAML questions (except the first one) so be sure to
verify that with the spec. Maybe E26 of the approved errata helps:
http://docs.oasis-open.org/security/saml/v2.0/sstc-saml-approved-errata-2.0.html
-peter