Shibboleth SP session timeout notification to IdP (PortalGuard)

[gbrowins]

Hi Sai,

We discussed this directly with you last year so I'm just adding this post
for historical/paper trail purposes.

For native IIS forms-based authentication, the session cookie is the only
evidence of the user's successful login and is all that's required to prove
the user's prior successful authentication & identity. The IIS server does
not have an in-memory representation that could be invalidated by something
like a web service called from the service provider itself.

PortalGuard has a URL (e.g. "/_layouts/PG/signout.aspx") that can be called
to terminate the IIS session and redirect them to a different URL but this
must be called by the user's browser.

I believe we ended up shortening the session timeout in PortalGuard's IIS
web.config and disabling sliding expiration. This allowed you to have the
session controlled solely on the service provider side rather than having a
new session created by an automatic redirection to the PortalGuard Identity
Provider.

   -Gregg




--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Shibboleth-SP-session-timeout-notification-to-IdP-PortalGuard-tp7588709p7607921.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.