Different SSO session timeouts based on IP

[Aaron Howell]

Thanks for your responses. The meeting ended up going very well from my point of view.

> On 19 Jul. 2016, at 9:05 am, Peter Schober <peter.schober at univie.ac.at> wrote:
>
> * Aaron Howell <aaron.howell at deakin.edu.au> [2016-07-18 22:28]:
>> We have some "kiosk" machines that are always logged in. People are
>> using Shibboleth protected sites on them and forgetting to close the
>> browser or logout.
>
> Simply pre-selecting the "Don't Remember Login" (i.e., disable SSO)
> check-box on the IDP's login page in JavaScript based on client IP
> range would help a but, I guess.
>
> Also, just a reminder of other tools you have at your disposal,
> outside Shibboleth. (I'm assuming you control your own kiosks, or can
> influence their workings with AUD. If not get another vendor or
> in-source. :))
>
> At least have the people/company managing those machines put an icon
> on the screen, on the browser or outside, always prominently visible,
> that will kill the whole browser/X11 session/GUI/state, and make sure
> sessions are not restored across browser restarts. (If all people can
> use is a browser maybe a large icon that removes all cookies is
> sufficient technically, plus documentation next to the terminal.)
>
> That's easy do to, works reliably with any kind of software or website
> or service, can be made very prominent visually, and can be
> prominently documented on signs right next to the screen of the
> terminal, warning people to take care about their data (as it's their
> own responsibility then, with nothing to complain about, really). That
> alone should limit the number of people walking away with active
> sessions, at least over time.
>
> You can also add local software that does the same (kills the GUI
> session or browser) if no input (keyboard input, mouse click or
> movement) has been detected for some time (seconds? minutes? depends
> on what people have to do on those machines). I'd consider that a
> safety net but of course its effects might undermine the "learning
> experience" of [not] doing doing that one click yourself.
>
> I've also heard of sensors in front of the kiosk, which kill all
> sessions once someone steps away, but of course not even that is fool
> proof (with too fast/simultaneous turnover, etc.) and more involved,
> even with ever cheaper and smaller electonics that connect everything.
>
> -peter
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


Important Notice: The contents of this email are intended solely for the named addressee and are confidential; any unauthorised use, reproduction or storage of the contents is expressly prohibited. If you have received this email in error, please delete it and any attachments immediately and advise the sender by return email or telephone.

Deakin University does not warrant that this email and any attachments are error or virus free.