zombie sessions

[IAM David Bantz]

That helps some, but the login handler authentication duration is allegedly
set to 8 hours as well:

  <!--
>         Replace all active login handlers with the following to use the
> MCB, so that it can handle and/or
>         examine all authentication requests as they come in.
>     -->
>     <ph:LoginHandler xsi:type="mcb:MultiContextBroker"
> authenticationDuration="PT8H0M0.000S" previousSession="true"
>         depends-on="mcb.Configuration">
>         <ph:AuthenticationMethod>
> urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</ph:
> AuthenticationMethod>
>         <ph:AuthenticationMethod>
> urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:
> AuthenticationMethod>
>         <ph:AuthenticationMethod>
> urn:oasis:names:tc:SAML:2.0:ac:classes:Password</ph:AuthenticationMethod>
>         <ph:AuthenticationMethod>https://iam.alaska.edu/trac/wiki/mfa</ph:
> AuthenticationMethod>
>         <ph:AuthenticationMethod>
> urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession</ph:
> AuthenticationMethod>
>     </ph:LoginHandler>

All other methods in the distributed file commented out.

David Bantz

On Tue, Jun 14, 2016 at 12:46 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > I've thought we have had 8 hour SSO sessions since the late Pleistocene,
> > based on this config in
> >    ... /conf/internal.xml:
>
> Neither V2 nor V3 rely on the session lifetime itself for SSO. Individual
> login methods, handlers, flows, whatever all have their own lifetime and
> timeout settings that control SSO.
>
> The IdP session itself can live forever with constant use. Has nothing to
> do with SSO lifetime.
>
> > But a vendor's SP is keeping a session alive indefinitely by
> periodically issuing
> > SAML request like:
>
> You can keep a session alive, but you can't bypass the life of the
> authentication method.
>
> > which my IdP is honoring with previous session handler; here's what I
> think is
> > pertinent log snippet:
>
> > [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:478]
> > - Basing previous session authentication on active authentication method
> > https://iam.alaska.edu/trac/wiki/mfa
>
> If it's active, then it's active. That has nothing to do with the session
> lifetime.
>
> > I must be missing something. How do I limit the IdP SSO session to 8
> hours?
>
> That's up the login handler(s).
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160614/34d6bddd/attachment.html>