Shibboleth session vs Application session

[Sathish Anickode]

The documentation states the following (https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUserAuthn). It does mention that the statement is confusing.  Does that indicate that the inactivity timeout is not supported?

Session Lifetime

The session lifetime is configured in the IDP_HOME/conf/internal.xml file. Locate the shibboleth.SessionManager bean. Its second constructor argument is the inactivity timeout, in milliseconds, for the session. By default it is 30 minutes.

Admittedly, this is a totally confusing and poorly represented setting. It will be changed in a future release.

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, December 05, 2014 10:59 AM
To: Shib Users
Subject: Re: Shibboleth session vs Application session

On 12/5/14, 4:24 PM, "Sathish Anickode" <SAnickode at skytouchtechnology.com> 
wrote:


>
>Based on the PCI requirements, I think it is fine if the IdP cookie has a 
>life time of 8 hrs as long as the inactivity timeout is set to 15 
>minutes. We would also configure the application sessions to timeout 
>after 15 minutes of inactivity.

There is no inactivity timeout in the IdP. There is only authentication 
method duration/lifetime applying individually to each login handler's 
authentication result. It is a lifetime, not a timeout.

>In this scenario, if the user accesses a different application that uses 
>the same SSO after 15 minutes, they will be forced to re-authenticate, as 
>the IdP cookie would have expired due to inactivity. Is there a way to 
>keep the IdP cookie from timing out due to inactivity while an 
>application session is active?

There is no such timeout.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net