Documentation for Shibboleth SP timeouts?

[Cantor, Scott]

On 3/31/14, 11:50 AM, "James W. Anderson" <jamesanderson at coca-cola.com>
wrote:

>The documentation in the Shibboleth wiki is somewhat obtuse when it comes
>to sessions and session timeouts. Does anyone have a PDF or other source
>of documentation that better explains all the settings that influence
>session timeouts, both from the SP side and from the IdP/assertion side?

Anything you didn't get from the official site would almost certainly be
wrong, and just lead you down a mistaken path.

> 
>I thought that if I set timeout=1800 in shibboleth2.xml that my sessions
>would not timeout until 1800 seconds/30 minutes of inactivity. This was
>not the case. I discovered that my Identity Provider dictated the
>duration of the session, and that the session timeout is absolute: if the
>IdP says the session timeout is 30 minutes, then I have 30 minutes from
>the time I authenticate, regardless of whether I¹m active the whole time.
>This is based on what I see when I look at /Shibboleth.sso/Session‹the
> session duration counts down regardless of whether I¹m active.

The SessionNotOnOrAfter value from the IdP is a cap on the lifetime of the
session, not the timeout. It will limit the lifetime, unless the SP
setting is lower. The timeout is a separate matter, but by definition a
longer timeout than the lifetime won't do much.

There is nothing else from the IdP that has anything to do with it.

-- Scott