IDP session timeout

[Cantor, Scott]

> I am not sure  I understood your response. In the scenario I mentioned, i
> was hoping that through some back channel SOAP request  (or any other
> shibboleth specific method), Service Provider will keep checking if the
> session at IDP is active.

And that is not the case. There is no requirement in SAML for any polling like that.

> It would not be a good user experience, if he
> comes to know that the IDP session has expired but still the Service
> Provider (web application) is still having an active session.

IdP timeouts impact SSO and how often users are rechallenged. They have nothing to do with application sessions. This is the web, full of disconnected systems, not a mainframe.

If you want to cap SP sessions, you set the SessionNotOnOrAfter attribute, which forces new logins on more specific timetables, giving the IdP a chance to step in. And users will generally lose all their work in progress,and be more confused and annoyed in the process.
 
-- Scott