Un-solicitated SSO queries

[Ajay Arora]

Hi,

I am at the Shibboleth IDP end and am doing SSO with a cloud Service Provider. It is using Un-solicitated (IDP initiated) SSO where users authenticate (using LDAP Active Directory) at my site and then are re-directed to Service Provider. When user log-out from Service Provider, their SP session is terminated and browser is re-directed to my Shibboleth logout page (/userProfile/Logout) wherein I remove the _idp_session and 'JSESSIONID' cookies and invalidate the session. 

Does it look like a typically Un-solicitated SSO flow or am I missing something? Is there any other clean-up/graceful resource release that should be done?

What factors I should consider to arrive at various session timeouts? On an average, users stay at the SP site for about 10 minutes. 

To begin with, I have configured both my web application (web.xml session-timeout) and Shibboleth IDP (shibboleth.SessionManager constructor argument in internal.xml and LoginHandler authenticationDuration in handler.xml) session time out  to 20 minutes. I have a feeling that these two should usually match.  

Should I ask SP to configure their session-timeout to also 20 minutes? 

Are their any guidelines for arriving at session timeout in such Un-solicitated SSO cases? Should all the three match? Or, do the two timeouts at my end be larger than the Vendor SP timeout?  


Thanks,
Ajay  
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140228/1e87befe/attachment.html