Shibboleth session vs Application session

[Cantor, Scott]

On 12/4/14, 8:27 PM, "Sathish Anickode" <SAnickode at skytouchtechnology.com> 
wrote:



>I find that the shibboleth session and application session are distinct 
>and each have their own time to live.

Assuming there is an application session, yes.

> However, I wanted to confirm if the life time for session tokens behave 
>as follows:
>
>Shibboleth session will live for a set duration while the application 
>session, which also has a set duration, extends each time the application 
>is accessed.

There's no single answer to that, application sessions depend on the 
application, obviously. The SP session has both a lifetime maximum and a 
timeout.

> However, Shibboleth sessions is not updated after each application 
>access and does
> not extend beyond the preset expiration time.

I don't know what that means, but the SP lifetime is an absolute maximum 
set up front and it never goes past that. The inactivity timeout is based 
on last access and that's updated every time the session is used. I have 
no idea what any application does or doesn't do, that's not in scope of my 
software.

> 
>As per PCI-DSS 3.0 standards, each application should have  session 
>timeout set to 15 minutes after which the user should be forced to 
>authenticate again. Can you please let me know what would be the best 
>practice for setting appropriate shibboleth session timeout to accomplish 
>this requirement?

You'd have to start by determining what somebody saying "timeout" actually 
means, because that's just not technically precise.

-- Scott