Shibboleth session vs Application session

[Sathish Anickode]

I would like to better understand how the user session timeout work. It appears that there is one user session on the IdP that tracks all the services where the user has authenticated and this session will timeout due to inactivity. 

If my above assumptions are correct, then each time the user authenticates with a SP, the timeout on this session is reset. Can you please confirm if my understanding is correct?

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, December 08, 2014 8:37 AM
To: Shib Users
Subject: Re: Shibboleth session vs Application session

On 12/8/14, 3:25 PM, "Sathish Anickode" <SAnickode at skytouchtechnology.com>
wrote:

>The following link
>(https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthnSession)
>states that the user will be forced to authenticate when the user 
>session expires even though the authentication method lifetime has not exceeded.

That's true.

>If this is the case, can we set the user session expiration to 15 
>minutes and periodically refresh the session if the user is actively using an SP?

The session "lifetime" is actually a timeout, so there is no fixed expiration. The authentication methods are explicitly a fixed duration. 
And no, there is no way to do that unless you're going to do some kind of hacky polling trick.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net