Shibboleth 3 idp session timeout configuration

[Priyanshu Bhalotia]

Say that the IDP authn timeout is 60m and SP timeout is also 60 m but simce SP uses sliding window concept say it uses the application after 45 mins from its session login.. the session must be valid till after 45+60 mins and when the user at 75 mins after the original login tries to switch SP it will be redirected to IDP  login page whereas the user would ideally want to be logged in on switching the sp. 


So what configuration changes must beade to make something like this work

Thanks for the help

On 06-Oct-2016, at 9:12 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

>> idp.session.timeout is by default 60m..what security and resource issues are
>> most likely to happen when i increase the timeout to say 24h.
> 
> I couldn't give you numbers no matter what, I don't have them, but that depends on the storage strategy involved. Storing data on the client doesn't impose much of any impact on the server. Otherwise it has very obvious impacts. That's one of many reasons why I use the client.
> 
>> idp.authn.defaultlifetime=PT60M
>> idp.authn.defaultTimeout=PT30M
>> 
>> similarly what security and resource based problems am i most likely to
>> encounter on increasing the defualtlifetime to say 8hrs and defaultimeout
>> accordingly.
> 
> Same answer, plus obviously increased security risk if you think SSO is a risk. That's a personal decision.
> 
>> If Suppose IDP is configured such that idp.authn.defaultTimeout is 60
>> minutes while the idp.authn.defaultLifetime is 120 min, SP session timeout is
>> 120 minutes. There is only activity at front channel at SP but no back end
>> channel activity. Then after 60 minutes,IDP timeout will occur due to
>> inactivity but SP session is still valid and then suppose SP redirects to SP2
>> after 90 mins from initial login time which follows the same SSO settings so it
>> will then not get authenticated and get redirected to IDP login page. How can
>> i manage the session configuration so as to avoid such conditions without
>> compromising on security??
> 
> I don't know what you're asking. The scenario there is that the second request to the IdP is 90 minutes after the first, and you said the authn timeout is 60 minutes, so that means it will be timed out and the second request will repeat authentication again. If that's not what you want, change the numbers.
> 
> -- Scott
> 
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161007/694d92a5/attachment.html>