Premature Authn Result Expiration w/MFA

[Marvin Addison]

On Mon, Sep 19, 2016 at 10:04 AM Cantor, Scott <cantor.2 at osu.edu> wrote:

> I can spin something up here and try and verify the testbed is honoring a
> timeout longer than an hour.
>

Thanks -- really appreciate that.

What are the settings you're using?
>

I think this is all you need from idp.properties. Let me know if you need
further information:

# Set to "shibboleth.StorageService" for server-side storage of user
sessions
idp.session.StorageService = shibboleth.MemcachedStorageService

# Size of session IDs
#idp.session.idSize = 32
# Bind sessions to IP addresses
# VTAS-102: Disable due to a number of issues on VT network
idp.session.consistentAddress = false
# Inactivity timeout
idp.session.timeout = PT24H
# Extra time to store sessions for logout
#idp.session.slop = 0
# Tolerate storage-related errors
#idp.session.maskStorageFailure = false
# Track information about SPs logged into
idp.session.trackSPSessions = true
# Support lookup by SP for SAML logout
# VTAS-104
idp.session.secondaryServiceIndex = true
# Length of time to track SP sessions
# Set conservatively high to session inactivity timeout
idp.session.defaultSPlifetime = PT24H

# Regular expression matching login flows to enable, e.g. IPAddress|Password
idp.authn.flows= X509Internal|MFA|Password|X509|conditions/iforgot

# Regular expression of forced "initial" methods when no session exists,
# usually in conjunction with the idp.authn.resolveAttribute property below.
#idp.authn.flows.initial = Password

# Set to a quoted attribute ID to resolve prior to selecting authentication
flows;
# its values are used to filter the flows to allow.
#idp.authn.resolveAttribute = eduPersonAssurance

# Default lifetime and timeout of various authentication methods
idp.authn.defaultLifetime = PT24H
idp.authn.defaultTimeout = PT24H

# Whether to prioritize "active" results when an SP requests more than
# one possible matching login method (V2 behavior was to favor them)
#idp.authn.favorSSO = true

# Whether to fail requests when a user identity after authentication
# doesn't match the identity in a pre-existing session.
#idp.authn.identitySwitchIsError = false

M <users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160919/6151cab5/attachment.html>