Shibboleth session vs Application session

[Cantor, Scott]

On 12/11/14, 11:19 PM, "Sathish Anickode" 
<SAnickode at skytouchtechnology.com> wrote:

>Thanks for your reply. Based on discussions and a better understanding of 
>Shibboleth inner workings, I would like to clarify my requirements:
>
>Per the PCI requirements, I want the user to be forced to re-authenticate 
>if there were no activity on any associated SP sessions for more than 15 
>minutes. We need not re-authenticate if the user did an activity in at 
>least one of the SP sessions in the last 15 minutes.

That's impossible with this software. The IdP has no idea what is 
happening at any SPs, and the SPs have no idea what's happening at other 
SPs.

The web is not compatible with "global" views of timeout or logout without 
additional polling features that are not part of any standards.

You do not want SSO here, it's that simple. If you leave it on any 
significant way, you won't get this behavior. And even if you don't 
support SSO, Eric explained why "reauthenticate" means nothing precise in 
modern systems. Many strong authentication mechanisms operate at layers 
outside the IdP's control.

-- Scott