zombie sessions

[Cantor, Scott]

> I've thought we have had 8 hour SSO sessions since the late Pleistocene,
> based on this config in
>    ... /conf/internal.xml:

Neither V2 nor V3 rely on the session lifetime itself for SSO. Individual login methods, handlers, flows, whatever all have their own lifetime and timeout settings that control SSO.

The IdP session itself can live forever with constant use. Has nothing to do with SSO lifetime.

> But a vendor's SP is keeping a session alive indefinitely by periodically issuing
> SAML request like:

You can keep a session alive, but you can't bypass the life of the authentication method.

> which my IdP is honoring with previous session handler; here's what I think is
> pertinent log snippet:

> [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:478]
> - Basing previous session authentication on active authentication method
> https://iam.alaska.edu/trac/wiki/mfa

If it's active, then it's active. That has nothing to do with the session lifetime.

> I must be missing something. How do I limit the IdP SSO session to 8 hours?

That's up the login handler(s).

-- Scott