unexpected SSO session timeout

[IAM David Bantz]

My idp V 3.2.1 is expiring SSO sessions more quickly than I thought I had
configured in .../conf/idp.properties:

idp.authn.defaultLifetime = PT10H

> idp.authn.defaultTimeout = PT8H

> # Inactivity timeout
#idp.session.timeout = PT8H

But logins to relying parties challenge for authN within about 3 hours.
(Verified this on a client with single wired network connection with fixed
IP, after verifying expected longer-lived SSO session on still running V2
IdP).

I find this additional reference to idp timeout
in session-manager-system.xml

   <bean id="shibboleth.SessionManager" class=
"net.shibboleth.idp.session.impl.StorageBackedSessionManager"
            depends-on="shibboleth.OpenSAMLConfig"
            ...
            p:sessionTimeout="%{idp.session.timeout:PT60M}"

Is that the correct place to extend SSO session lifetime ?
Will I need to rebuild the IdP for a change to take effect?

David Bantz
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161216/4b07b885/attachment.html>