Shibboleth-SP handling of long delay in user logging in with IdP

[Nate Klingenstein]

Also, mostly for the archives, this could hypothetically happen if the IdP is sending back incorrect RelayState values.  I think that's explicitly prohibited by the specification but it's certainly not out of the realm of imagination if the IdP session is timing out but the IdP is willing to treat it as an unsolicited SSO request.

Sending the user to an SP-designated URL is a protection mechanism.  The inability to perform this check is one of the drawbacks of IdP-initiated SSO, so I would leave it in place if you can.

https://issues.oasis-open.org/browse/SECURITY-12

On Jul 7, 2014, at 6:42 PM, Nate Klingenstein <ndk at internet2.edu>
 wrote:

Jo,

The behavior you're experiencing is because the SP is losing the page that the user had been on a long, long time ago in a place far, far away.  That can be persisted in a couple of ways.

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPStorageService

Ultimately, the SP needs to know where to send the user upon receipt of a valid assertion, and that's either "default" or "where I told myself they came from".  I think the easiest way to do that in your situation is just changing the timeout.

1.       If I set session timeout to 0 will the user be able to log in up to the session lifetime?

>From the docs at

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions

  *   timeout(time in seconds) (default is 3600)
     *   Maximum inactivity allowed between requests in a session maintained by the SP. This inactivity applies only to requests to this SP and is not aware of activity between the browser and other web sites (or even otherapplications<https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplication> on this system). A value of 0 disables timeout checking.


2.       Is there any way to handle this differently, like redirect to some URL?

You can set the homeURL to anything you would like through a variety of mechanisms.  You can also set an explicit target URL.  There are other storage mechanisms.  Searching the Wiki for "homeurl" will give you some starting points.

Hope this helps,
Nate.
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140708/552666b0/attachment.html