IdP 3 password flow login page goes stale

[Michael Nielsen]

I constantly marvel at the configurability of Shibboleth.  Despite the very good documentation, and my improving understanding after having spent a couple of days trying to understand this, I haven't adequately resolved what seems to be a fairly straightforward function.

I am using a password flow with LDAP and the default StorageService  with a 30 minute cleanup interval.  idp.session.StorageService is set to shibboleth.StorageService.

If a user lingers on the login page for too long (> 10 minutes, < 15 minutes) and then enters a user name and password, the authentication proceeds but doesn't end up at the correct location on the SP.  After 15 minutes, the authentication fails.

One theory was that the login attempt gets bound to an LDAP thread when the page is presented, then the LDAP thread is reaped due to inactivity, since my idp.pool.LDAP.idleTime is 900.  That, in my sketchy view of the function of the IdP, could explain authentication failing after 15 minutes.

I am at a loss to understand the ">10 minute" problem though.  It seemed to me that it might be that the object representing the login attempt in the cache was expiring, explaining why the IdP doesn't know to where to return the user.  Unfortunately I don't know how to test this theory.

Are these hypotheses plausible?

Is/are there configuration setting/s that could control how long a login page stays current?

Thanks for any help you may be able to offer.







-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170824/033113fa/attachment.html>