zombie sessions

[IAM David Bantz]

I've thought we have had 8 hour SSO sessions since the late Pleistocene,
based on this config in
   ... /conf/internal.xml:

<bean id="shibboleth.SessionManager"
class="edu.internet2.middleware.shibboleth.idp.session.impl.SessionManagerImpl"
depends-on="shibboleth.LogbackLogging">
        <constructor-arg ref="shibboleth.StorageService"/>
        <constructor-arg value="28800000" type="long"/>
    </bean>
But a vendor's SP is keeping a session alive indefinitely by periodically
issuing SAML request like:

07:52:36.443 - DEBUG [PROTOCOL_MESSAGE:113] -
> <?xml version="1.0" encoding="UTF-8"?><samlp:AuthnRequest
> xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
> AssertionConsumerServiceURL="
> https://www.getrave.com/Shibboleth.sso/SAML2/POST" Destination="
> https://idp.alaska.edu/idp/profile/SAML2/Redirect/SSO"
> ID="_1f3710c222e5e9cac6121886423704dd" IssueInstant="2016-06-14T15:52:36Z"
> ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
> Version="2.0">
>    <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">
> https://www.getrave.com/shibboleth-sp</saml:Issuer>
>    <samlp:NameIDPolicy AllowCreate="1"/>
> </samlp:AuthnRequest>


which my IdP is honoring with previous session handler; here's what I think
is pertinent log snippet:

 00:22:36.597 - DEBUG
> [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:157]
> - No custom or group-based relying party configuration found for
> https://www.getrave.com/shibboleth-sp. Using default relying party
> configuration.
> 00:22:36.597 - DEBUG
> [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:226]
> - Creating login context and transferring control to authentication engine
> 00:22:36.598 - DEBUG
> [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:181] -
> Storing LoginContext to StorageService partition loginContexts, key
> 899a272afc03b832c9cbdc8543c6fd876f6fa52400fd8b1928b9bc89ef9fc4d5
> 00:22:36.598 - DEBUG
> [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:240]
> - Redirecting user to authentication engine at
> https://idp.alaska.edu:443/idp/AuthnEngine
> <https://idp.alaska.edu/idp/AuthnEngine>
> 00:22:36.604 - DEBUG
> [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:209] -
> Processing incoming request
> 00:22:36.605 - DEBUG
> [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:240] -
> Beginning user authentication process.
> 00:22:36.605 - DEBUG
> [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:244] -
> Existing IdP session available for principal dabantz
> 00:22:36.605 - DEBUG
> [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:283] -
> Filtering configured LoginHandlers:
> {urn:oasis:names:tc:SAML:2.0:ac:classes:Password=edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler at 74c9a375,
> urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession=edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler at 74c9a375,
> urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified=edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler at 74c9a375
> ,
> https://iam.alaska.edu/trac/wiki/mfa=edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler@74c9a375,
> urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport=edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler at 74c9a375
> }
> 00:22:36.605 - DEBUG
> [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:464] -
> Selecting appropriate login handler from filtered set
> {urn:oasis:names:tc:SAML:2.0:ac:classes:Password=edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler at 74c9a375,
> urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession=edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler at 74c9a375,
> urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified=edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler at 74c9a375
> ,
> https://iam.alaska.edu/trac/wiki/mfa=edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler@74c9a375,
> urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport=edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler at 74c9a375
> }
> 00:22:36.605 - DEBUG
> [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:467] -* Authenticating
> user with previous session LoginHandler*
> 00:22:36.605 - DEBUG
> [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:478] -
> Basing previous session authentication on active authentication method
> https://iam.alaska.edu/trac/wiki/mfa
> 00:22:36.606 - DEBUG
> [edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler:91]
> - MCBConfiguration bean =
> [edu.internet2.middleware.assurance.mcb.authn.provider.MCBConfiguration at 1a2f9dd
> ]


I must be missing something. How do I limit the IdP SSO session to 8 hours?

David Bantz
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160614/65052c35/attachment-0001.html>