multiple timeouts against the same IDP

[Flannery, Sean]

Hello,

I have the following problem and I'm not sure if it stems from a general
misunderstanding of SAML or if I'm just implementing things inccorectly in
Shibboleth SP.

The issue:

* we have a request to protect some apps with much stricter session
timeouts than other apps (at the SP level), but our IDP team wants these
different apps to use the same realm.

* I've used the ApplicationOverride feature to protect different URLs with
different timeouts and that works fine, but, at least the way I'm doing
it, a new ApplicationOverride entry requires a unique IDP realm .  More
specifically, I have to give the ApplicationOverride a unique entityID
and, by doing so, that means it won't match the audienceRestriction coming
back from the default IDP realm, thus the IDP team must raise a new realm
for each override.

What I'm wondering is:

* is that just the way SAML is supposed to work, and you're not supposed
to have different SP apps with different timeouts, pointing to the same
IDP realm?

or

* is there a  better way to implement this?  Where I can setup different
app policies in the SP, but still be in compliance with the
audienceRestriction that comes back from the IDP?

Hope the question makes sense.  Thanks for your time.

Sean




________________________________
This transmission is intended solely for the person or organization to whom it is addressed and it may contain privileged and confidential information. If you are not the intended recipient you should not copy, distribute or take any action in reliance on it. If you believe you received this transmission in error please notify the sender.