shibboleth idp 2.4.3 Timeout

[Peter Schober]

* samir el otmani <elotmani.samir at gmail.com> [2014-12-05 13:08]:
> i need to customize the IDP timeout

Usually I'd ask what specifically you mean with "the IDP timeout" but
you seem to have very specific ideas on how to achive that.

> i tried to set the timeout from internal.xml
> by modifying the contructor-arg value :
> 
>   <bean id="shibboleth.SessionManager" class="edu.internet2.middleware.shibboleth.idp.session.impl.SessionManagerImpl" depends-on="shibboleth.LogbackLogging">
>       <constructor-arg ref="shibboleth.StorageService"/>
>       <constructor-arg value="60000" type="long"/>
>     </bean>

OK, 1 min instead of 30.

> and also in the handler.xml file by modifying authenticationDuration to 1
> min
> 
> <ph:LoginHandler xsi:type="ph:RemoteUser" authenticationDuration="1">
>   <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</ph:AuthenticationMethod>
>   <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod>
> </ph:LoginHandler>

And you're actually using the RemoteUser handler, right?
Do you have the PreviousSession login handler active in your IDP, and
if so why use the Shib session at all?

Note that I have an XSD time duration in my authenticationDuration
(e.g. "PT1M" in your case) but the wiki says it's in minutes, so you
should be fine.
I also recall some (other) issue with multiple AuthenticationMethod
child elements, but that's unlikely to be related to your case.

> and it doesnt work at all , the IDP session .
> finally i need to know how to verify correctly if the idp session is
> timeout or no , i only verify if the idp's cookies is removed JSESSIONID
> and _idp_session

Not sure what you're asking. I'd try to log in to an SP, then wait a
minute, then try to log in to another SP. You should be sent to the
service providing RemoteUser then, i.e., the IDP session had expired
and the IDP sent you to the external service for authn again.
How that service treats you (with SSO or not) is up to that service.

I think you can just remove the PreviousSession login handler to
achieve what you want.
-peter