Shibboleth 3 idp session timeout configuration

[Cantor, Scott]

> idp.session.timeout is by default 60m..what security and resource issues are
> most likely to happen when i increase the timeout to say 24h.

I couldn't give you numbers no matter what, I don't have them, but that depends on the storage strategy involved. Storing data on the client doesn't impose much of any impact on the server. Otherwise it has very obvious impacts. That's one of many reasons why I use the client.

> idp.authn.defaultlifetime=PT60M
> idp.authn.defaultTimeout=PT30M
> 
> similarly what security and resource based problems am i most likely to
> encounter on increasing the defualtlifetime to say 8hrs and defaultimeout
> accordingly.

Same answer, plus obviously increased security risk if you think SSO is a risk. That's a personal decision.

> If Suppose IDP is configured such that idp.authn.defaultTimeout is 60
> minutes while the idp.authn.defaultLifetime is 120 min, SP session timeout is
> 120 minutes. There is only activity at front channel at SP but no back end
> channel activity. Then after 60 minutes,IDP timeout will occur due to
> inactivity but SP session is still valid and then suppose SP redirects to SP2
> after 90 mins from initial login time which follows the same SSO settings so it
> will then not get authenticated and get redirected to IDP login page. How can
> i manage the session configuration so as to avoid such conditions without
> compromising on security??

I don't know what you're asking. The scenario there is that the second request to the IdP is 90 minutes after the first, and you said the authn timeout is 60 minutes, so that means it will be timed out and the second request will repeat authentication again. If that's not what you want, change the numbers.

-- Scott