Shibboleth session vs Application session

[Eric Goodman]

Or "what he said"...

I'll note that while it might appear that Scott and I contradicted each other in our last posts, the responses are actually in agreement with each other. Scott's answer just assumes that you need the most restrictive use case I described (which I can believe PCI DSS probably implies) AND that you don't have absolute control over each SP and IdP of interest. 

--- Eric

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, December 11, 2014 4:45 PM
To: Shib Users
Subject: Re: Shibboleth session vs Application session

On 12/11/14, 11:19 PM, "Sathish Anickode" 
<SAnickode at skytouchtechnology.com> wrote:

>Thanks for your reply. Based on discussions and a better understanding 
>of Shibboleth inner workings, I would like to clarify my requirements:
>
>Per the PCI requirements, I want the user to be forced to 
>re-authenticate if there were no activity on any associated SP sessions 
>for more than 15 minutes. We need not re-authenticate if the user did 
>an activity in at least one of the SP sessions in the last 15 minutes.

That's impossible with this software. The IdP has no idea what is happening at any SPs, and the SPs have no idea what's happening at other SPs.

The web is not compatible with "global" views of timeout or logout without additional polling features that are not part of any standards.

You do not want SSO here, it's that simple. If you leave it on any significant way, you won't get this behavior. And even if you don't support SSO, Eric explained why "reauthenticate" means nothing precise in modern systems. Many strong authentication mechanisms operate at layers outside the IdP's control.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net