Different SSO session timeouts based on IP

[Cantor, Scott]

> Is there a way to apply different SSO session limits at the IdP based on IP
> address? (or as they are domain joined - machine name)

Different limits is not so easy at the moment, but no SSO at all is definitely possible conditionally, you can attach conditions to determine whether to persist authentication results.

Also, I anticipated that people might eventually play with the currently-user-driven Do not cache option by setting that programmatically based on networks, but we haven't really done any work to make that a real feature yet, and it amounts to the same thing anyway, that just drives one of the inputs to the condition I'm referring to above.

The setting is referred to in the various authn config files as resultCachingPredicate.

> Personally I think they are trying to address the issue at the wrong location -
> and should actually address the insecure-by-design kiosks - but currently that
> suggestion is considered too much work.

Well, it's a lose-lose problem. This is where logout actually matters and unfortunately that doesn't really solve anything.

-- Scott