Shibboleth session vs Application session

[Sathish Anickode]

Thanks for your reply. I wanted to additionally clarify the following:

We are planning to use WebLogic SAML integration. Additionally, since our existing application uses container sessions extensively, we will be using our application session instead of the Shibboleth session.

Following is the PCI DSS 3.0 requirement (https://www.pcisecuritystandards.org/documents/PCI_DSS_v3.pdf ) related to session inactivity:

PCI DSS Requirements

Testing Procedures

Guidance

8.1.8 If a session has been idle for more than 15 minutes, require the user to re-authenticate to re-activate the terminal or session.

8.1.8 For a sample of system components, inspect system configuration settings to verify that system/session idle time out features have been set to 15 minutes or less.

When users walk away from an open machine with access to critical system components or cardholder data, that machine may be used by others in the user's absence, resulting in unauthorized account access and/or misuse.
The re-authentication can be applied either at the system level to protect all sessions running on that machine, or at the application level.


Thanks.



-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, December 04, 2014 1:38 PM
To: Shib Users
Subject: Re: Shibboleth session vs Application session



On 12/4/14, 8:27 PM, "Sathish Anickode" <SAnickode at skytouchtechnology.com<mailto:SAnickode at skytouchtechnology.com>>

wrote:







>I find that the shibboleth session and application session are distinct

>and each have their own time to live.



Assuming there is an application session, yes.



> However, I wanted to confirm if the life time for session tokens behave

>as follows:

>

>Shibboleth session will live for a set duration while the application

>session, which also has a set duration, extends each time the application

>is accessed.



There's no single answer to that, application sessions depend on the

application, obviously. The SP session has both a lifetime maximum and a

timeout.



> However, Shibboleth sessions is not updated after each application

>access and does

> not extend beyond the preset expiration time.



I don't know what that means, but the SP lifetime is an absolute maximum

set up front and it never goes past that. The inactivity timeout is based

on last access and that's updated every time the session is used. I have

no idea what any application does or doesn't do, that's not in scope of my

software.



>

>As per PCI-DSS 3.0 standards, each application should have  session

>timeout set to 15 minutes after which the user should be forced to

>authenticate again. Can you please let me know what would be the best

>practice for setting appropriate shibboleth session timeout to accomplish

>this requirement?



You'd have to start by determining what somebody saying "timeout" actually

means, because that's just not technically precise.



-- Scott



--

To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20141204/717b5624/attachment.html