Different SSO session timeouts based on IP

[Peter Schober]

* Aaron Howell <aaron.howell at deakin.edu.au> [2016-07-18 22:28]:
> We have some "kiosk" machines that are always logged in. People are
> using Shibboleth protected sites on them and forgetting to close the
> browser or logout.

Simply pre-selecting the "Don't Remember Login" (i.e., disable SSO)
check-box on the IDP's login page in JavaScript based on client IP
range would help a but, I guess.

Also, just a reminder of other tools you have at your disposal,
outside Shibboleth. (I'm assuming you control your own kiosks, or can
influence their workings with AUD. If not get another vendor or
in-source. :))

At least have the people/company managing those machines put an icon
on the screen, on the browser or outside, always prominently visible,
that will kill the whole browser/X11 session/GUI/state, and make sure
sessions are not restored across browser restarts. (If all people can
use is a browser maybe a large icon that removes all cookies is
sufficient technically, plus documentation next to the terminal.)

That's easy do to, works reliably with any kind of software or website
or service, can be made very prominent visually, and can be
prominently documented on signs right next to the screen of the
terminal, warning people to take care about their data (as it's their
own responsibility then, with nothing to complain about, really). That
alone should limit the number of people walking away with active
sessions, at least over time.

You can also add local software that does the same (kills the GUI
session or browser) if no input (keyboard input, mouse click or
movement) has been detected for some time (seconds? minutes? depends
on what people have to do on those machines). I'd consider that a
safety net but of course its effects might undermine the "learning
experience" of [not] doing doing that one click yourself.

I've also heard of sensors in front of the kiosk, which kill all
sessions once someone steps away, but of course not even that is fool
proof (with too fast/simultaneous turnover, etc.) and more involved,
even with ever cheaper and smaller electonics that connect everything.

-peter