IDP session timeout

[virajitha]

I came across this article that metnions on how the idp session can be
handled so that SP and IDP sessions could be synchronized. Could you please
provide your comments on this?

Rule 3. Service Providers (“App1” and “App2”) must send “SAML2 SSO Passive
requests” to increase the timeout of the IDP. Passive requests must be
generated automatically by the SP without knowing to the end user.

As an example, When user is active in the SP Application, Passive requests
can be generated in every 15min and sent to IDP to keep the IDP session
active. When user is not inactive in the SP Application, Passive requests
are not generated by SP. Therefore IDP session would be timeout after the
given timeout period. Therefore if “App1” and “App2” are invalidated, IDP
session also can be invalidated due to the timeout.  However,  when passive
requests are sending,  there would be some distraction for the end user as
there is a browser redirect. Therefore we need to handle it properly as
well.

But some SAML2 IDP may expose some web service API that can be called by the
SPs to increase the inactive time out of the IDP session.  In such cases, SP
can call this web service API using the back channel in every 15min (or any)
and keep the IDP session alive.  This would be much better approach rather
than using SAML2 Passive request (as there is a distraction for end user)

Thanks



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/IDP-session-timeout-tp7629470p7629500.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.