Idp session lifetime max value

[Cantor, Scott]

On 12/21/17, 3:00 PM, "users on behalf of GOSWAMI, Shivanggiri (Contractor)" <users-bounces at shibboleth.net on behalf of Shivanggiri.Goswami.contractor at oup.com> wrote:

>  What is the maximum value that can be set for idp.authn.defaultlifetime and idp.authn.idletimeout in idp.properties. I
> want a session to be valid for 6 months, is it possible?

There's not really any inherent maxium other than probably a limit on a data type size, nothing that would be hit with anything reasonable. But 6 months is ridiculous.

> I also have a requirement where I want different users to have different session expiry times(for e.g. 12 hour session for
> user1 and say 6 months session for user2), is this achievable? 

Not really, no.
 
> If a user is authenticated through web sso (shibboleth login page). Can I use the generated session
> cookie(shib_idp_session) in a subsequent ECP AuthRequest, ofcourse without authorization header to get the saml
> assertion for the same user.

Sessions and authentication reuse are entirely divorced from any specific profiles, the same sessions apply to any profile a single client happens to interact with. But no client would ever be doing both Browser SSO and ECP at the same time without something very questionable being involved.

-- Scott