mysteriously expiring sessions

[Cantor, Scott]

> Has anyone else observed Shibboleth incorrectly expiring session
> information from the cache? Is there any configuration option I should be
> looking at that would prevent this from happening? Thanks!

People report that all the time. Not one documented instance has ever been identified with proof.

Usually the session is invalidated and something in native.log mentions it happening. Address changing, that sort of thing. Also common with vendor IdPs to see SessionNotOnOrAfter set to a crazy value up front, and the SP enforces that as an upper bound.

Note that the expiration of the records in the cache is timeout driven, not lifetime driven. Accessing the session slides up the expiration by the timeout limit so that the record disappears if the timeout is reached. Lifetime limits are checked on every access.

Note also that there are many interacting settings in the SP alone, like the SessionCache's own policies, not to mention the application layer sorts of things that go on.

-- Scott