idp.session.slop

[Klingenstein, Nate]

Aaron,


IANAD, but I think I can interpret both of those.


Slop would be keeping the IdP's own sessions around slightly longer to prevent unnecessary errors in the event a logout request is received.  A lot of places like to use nearly synchronous session lifetimes for applications and logins.


Default SP lifetime is harder to guess to full scope of because SAML doesn't really constrain how long the session at the SP should live for.  Instead, that's likely to be how long to keep an SP associated with a session at the IdP -- timing out that particular interaction rather than the user's SSO session, to which it is affixed.  The lifetime of the assertion itself is nominal.


I'm an advocate for exposing IdP sessions for query stringable operations by SP's protected with client TLS, in which setting this would all be more tightly laced and hopefully intuitive, but I'm not aware of widescale federated use of that in the wild.


We'll find out if I'm wrong,

Nate.

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Aaron Howell <aaron.howell at deakin.edu.au>
Sent: Wednesday, April 26, 2017 5:07:23 PM
To: Shib Users
Subject: idp.session.slop

"idp.session.slop - Extra time after expiration before removing IdP sessions in case a logout is invoked” - https://wiki.shibboleth.net/confluence/display/IDP30/AuthenticationConfiguration

Is "IdP sessions" correct - or is it meant to be "SP sessions” ?

And what is the difference between using this setting and idp.session.defaultSPlifetime?

Cheers,
Aaron

Important Notice: The contents of this email are intended solely for the named addressee and are confidential; any unauthorised use, reproduction or storage of the contents is expressly prohibited. If you have received this email in error, please delete it and any attachments immediately and advise the sender by return email or telephone.

Deakin University does not warrant that this email and any attachments are error or virus free.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170427/c21d8203/attachment.html>