Shibboleth session vs Application session

[Eric Goodman]

> Thanks for your detailed reply. I was thinking of implementing exactly the
> same steps that you had outlined below to solve our needs. To refresh the
> user session, I am currently thinking of setting the authentication duration
> to a longer suration (e.g. 4 hrs) and session timeout to 15 mins. We then
> need a one page session refresh app that is stateless but accessed
> periodically from our custom applications while the user is actively using
> the app. However, I feel exposing an api or a page in the IdP  to touch the
> user session that can be invoked from our app will be a better solution than
> creating a single page application. Is it possible to add such a support in IdP?

Short answer is, I don't know. 

If you set your SP sessions to <15 minutes max lifetime (not idle), then that would redirect the user back to the IdP every 15 minutes (if they are active in the app), which would perhaps do the same thing, without burdening your applications with doing anything.

I'll reiterate the comments in this thread that all of this this is really a lot more complex than a typical Shib setup. You're using a product and protocol intended to provide loose coupling between authentication and application session management to try to implement a tightly coupled session management process. But it still sort of sounds like it's what you're asking for.

--- Eric