bindingTemplate.html

[Cantor, Scott]

On 3/31/15, 2:39 PM, "Paul G. Szabady" <paul_szabady at unc.edu> wrote:
>
>I recently changed my shibboeth SP (v2.5.3 on rhel 6) setup from the 
>older explicit sessioninitiator settings, etc to the newer SSO element 
>style.  Everything is working as expected, except for one piece.  I have 
>never seen the redirect page created by the bindingTemplate.html,

It's not a redirect, it's used when the POST binding is used.

>With my new configuration, I see the
>redirect page for a second or two and then get redirected to the 
>appropriate IdP.

There is no normal scenario under which the conversion would have any impact on this. If the POST binding is used, it would have been used before, or if not, not. Some other unusual set of options has to be involved, or the metadata for the IdP changed. The default outbound bindings have always favored HTTP-Redirect regardless of the syntax.

>Under normal circumstances, I wouldn't care, but we 
>have a proprietary application that is proxied through this SP.  It has 
>a number of drop down menus that now show "Shibboleth Authentication 
>Request" after about 10 mins of idle time, instead the drop down menu items.

POST could certainly break any number things, although the use of Javascript mostly renders it invisible to most things.

>1) Why would this cause an issue (timeout?) after 10 mins, when my 
>global timeouts are set much higher?

Session timeouts have nothing remotely to do with whatever you're describing.

>2) How/Where can I change this behavior?  I've been looking through the 
>confluence wiki, but can't seem to find it.

Fix the IdP's metadata to include a Redirect endpoint, generally.

-- Scott