Shibboleth session vs Application session

[Sathish Anickode]

Thanks for your clarifications.

Based on the PCI requirements, I think it is fine if the IdP cookie has a life time of 8 hrs as long as the inactivity timeout is set to 15 minutes. We would also configure the application sessions to timeout after 15 minutes of inactivity.

However, the application sessions timeout would renew as long as the users accesses the application within a 15 minute interval and consequently can extend the session indefinitely. In this scenario, if the user accesses a different application that uses the same SSO after 15 minutes, they will be forced to re-authenticate, as the IdP cookie would have expired due to inactivity. Is there a way to keep the IdP cookie from timing out due to inactivity while an application session is active? 


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, December 04, 2014 2:39 PM
To: Shib Users
Subject: Re: Shibboleth session vs Application session

On 12/4/14, 9:23 PM, "Sathish Anickode" <SAnickode at skytouchtechnology.com> 
wrote:



>Thanks for your reply. I wanted to additionally clarify the following:
> 
>We are planning to use WebLogic SAML integration. Additionally, since our 
>existing application uses container sessions extensively, we will be 
>using our application session instead of the Shibboleth session.

As Kevin said, then there is no Shibboleth session if you're not using the 
Shibboleth software.

Unless you mean the IdP, but that's much more complicated, now you're 
talking about SSO and those implications. That doesn't comport with any 
kind of control at the SP end. If you need that kind of control, you have 
to use ForceAuthn, and open that can of worms (cue Eric), or it doesn't 
matter what you do at the SP end.

With respect to the PCI statement, that is fundamentally at odds with SSO 
because it assumes that a timeout at the application end guarantees the 
ability to "force" reauthentication. So again, that's ForceAuthn, and few 
IdPs are going to give you that with any reliability.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net