IDP session lifetime

[Cantor, Scott]

On 4/26/17, 6:14 PM, "users on behalf of José Ramalho" <users-bounces at shibboleth.net on behalf of jramalho at ua.pt> wrote:

> I have been trying to change my session lifetime at IDP level (version 3.3).

You're mixing sessions all over the place so you need to be much more clear about what you're after (and you should understand that there's a good chance what you want isn't possible, sessions in a SSO environment are not easy to control tightly).

> So far I have changed idp.authn.defaultLifetime to 60 minutes but I keep getting 480 minutes from Sessions lifetime  (SP
> configuration value).

The SP session has nothing to do with the IdP session which has nothing to do with the authentication "lifetime". They are all decoupled, and the IdP session has no real security implications, so it's the one that's simplest to ignore.

If you want to influence (not control) the SP's session from the IdP, the only way to do that is not foolproof and involves the SessionNotOnOrAfter SAML feature, which can be controlled with the maximumSPSessionLifetime profile setting. [1]

> Shouldn’t  it be 60 minutes because it is the smaller value(IDP+SP)?

No.

I don't know where you're getting the 480 minute number or what you think that's actually applicable to.

-- Scott

[1] https://wiki.shibboleth.net/confluence/display/IDP30/SAML2SSOConfiguration