Reopened: Re: SessionNotFound

[Martin Haase]

Hi Scott,

please excuse me for answering so late on this SLO thread, there has
been both a timezone lag and a vacation lag. Let me get back to this.
Here is what my Session timeouts and lifetimes are set to:

grep  PT idp.properties|grep -v '#'
idp.session.timeout = PT8H
idp.session.slop = PT4H
idp.session.defaultSPlifetime = PT8H
idp.authn.defaultLifetime = PT8H

My suspicion is that the idp.session.timeout = PT8H (the inactivity
timeout) is not being honored, see " inactivityTimeout=1800000" in this
log snippet:

2017-06-21 10:59:52,396 - DEBUG
[org.springframework.webflow.execution.repository.impl.DefaultFlowExecutionRepository:121]
- Putting flow execution '[FlowExecutionImpl at 293cf92c flow =
'SAML2/Redirect/SSO', flowSessions = list[[FlowSessionImpl at 29fc819f flow
= 'SAML2/Redirect/SSO', state = 'DoAuthenticationSubflow', scope =
map[[empty]]], [FlowSessionImpl at 310ce85a flow = 'authn', state =
'CallAuthenticationFlow', scope = map['calledAsSubflow' -> true,
'calledAsExtendedFlow' -> [null]]], [FlowSessionImpl at 2563ce16 flow =
'authn/MFA', state = 'CallSubflow', scope = map['calledAsSubflow' ->
true, 'calledAsExtendedFlow' -> [null], 'mfaContext' ->
net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext at e770f9]],
[FlowSessionImpl at 6b58a60f flow = 'authn/Password', state =
'DisplayUsernamePasswordPage', scope = map['calledAsSubflow' -> true,
'viewScope' -> map[[empty]], 'calledAsExtendedFlow' -> [null],
'thisFlow' -> AuthenticationFlowDescriptor{flowId=authn/Password,
supportsPassive=true, supportsForcedAuthentication=true,
lifetime=28800000,*inactivityTimeout=1800000*}]]]]' into repository

What could be the problem here?

Regards

Martin
On 02.06.2017 15:46, Cantor, Scott wrote:
> I guess a caveat since you mentioned something about waiting an hour...the reverse indexing from the SP/NameID back to the IdPSession(s) to which it's been associated for logout is a separate stored record that has an expiration based on what you set your session policies to.
>
> Those records have an expiration that's based on how long you expect a given SP session to be around plus the sessionSlop value. So a failure to find a session in a totally separate browser would probably indicate that the logout attempt is happening after the reverse-index record had expired, meaning maybe you've got some values set too low.
>
> The reverse indexing is just a record containing the list of all the IdPSessions involved, and its expiration slides forward any time the list gets updated:
>
> Math.max(sessionList.getExpiration(), 
>                                          spSession.getExpirationInstant() + sessionSlop)
>
> (i.e. set expiration to the longer of "current" and "the new SPSession's expiration + slop value")
>
> -- Scott
>
>
>

-- 
Dr. Martin Haase, Solutions Engineer

DAASI International GmbH        
Europaplatz 3                   
D-72072 Tübingen                
Germany                    

phone: +49 7071 407109-0
fax:   +49 7071 407109-9  
email: martin.haase at daasi.de
web:   www.daasi.de

Sitz der Gesellschaft: Tübingen
Registergericht: Amtsgericht Stuttgart, HRB 382175
Geschäftsleitung: Peter Gietz

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170621/811de3e8/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2267 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20170621/811de3e8/attachment.p7s>