Inconsistency in idp.session.timeout documentation?

[Michael A Grady]

In the wiki page:

 https://wiki.shibboleth.net/confluence/display/IDP30/SessionConfiguration

it mentions that  "The IdP session uses a sliding window expiration policy that is updated under one of two conditions:" , and then lists those conditions. Then it defines the three core settings of:

	• idp.session.timeout (default PT60M)
	• idp.authn.defaultLifetime (default PT60M)
	• idp.authn.defaultTimeout (default PT30M)

and,  then, in the first example showing a sample conf/idp.properties file, has the following:

# IDP session must be at _least_ as long as authn result lifetime
idp.session.timeout=PT24H

But then, in the actual sample idp.properties in the 3.1.2 distribution, there is:

# Inactivity timeout
#idp.session.timeout = PT60M

So the implication from several of the above is that the session.timeout is based on inactivity, but the comment in that wiki page example:

  # IDP session must be at _least_ as long as authn result lifetime

doesn't seem to line up with that interpretation. Why would a session inactivity setting need to necessarily be as long as the maximum lifetime of an authn result? Doesn't it just need to be as long as the longest authn result inactivity timeout that one wants to support? 

--
Michael A. Grady
IAM Architect, Unicon, Inc.