idp.session.slop

[Cantor, Scott]

On 4/26/17, 8:07 PM, "users on behalf of Aaron Howell" <users-bounces at shibboleth.net on behalf of aaron.howell at deakin.edu.au> wrote:

> "idp.session.slop - Extra time after expiration before removing IdP sessions in case a logout is invoked” - 
> https://wiki.shibboleth.net/confluence/display/IDP30/AuthenticationConfiguration
>
> Is "IdP sessions" correct - or is it meant to be "SP sessions” ?

Yes, it's supposed to be referring to SP sessions.

> And what is the difference between using this setting and idp.session.defaultSPlifetime?

It overrides the latter with the actual value set for SessionNotOnOrAfter. If it thinks the session is supposed to last a specific amount of time then it uses that value instead of the default. The "slop" is a fixed buffer on top of that, which of course defaults to zero, so it doesn't mean anything by default.

Another way to look at it is that if you had an SP for which you knew the session lifetime, you could set that in SessionNotOnOrAfter and pass that on through to the storage layer so it would know that the record didn't have to be kept as long.

-- Scott