Inconsistency in idp.session.timeout documentation?

[Cantor, Scott]

On 11/3/15, 10:04 PM, "users on behalf of Michael A Grady" <users-bounces at shibboleth.net on behalf of mgrady at unicon.net> wrote:



>So the implication from several of the above is that the session.timeout is based on inactivity, but the comment in that wiki page example:
>
>  # IDP session must be at _least_ as long as authn result lifetime
>
>doesn't seem to line up with that interpretation. Why would a session inactivity setting need to necessarily be as long as the maximum lifetime of an authn result? Doesn't it just need to be as long as the longest authn result inactivity timeout that one wants to support?

Yes. The IdP session has no lifetime. The same one can live forever if you access the server enough. It has no security implications whatsoever. Anything with security implications that's stored inside the session has its own independent values to limit things.

-- Scott

>