session timeout confusion

[Liam Hoekenga]

We're currently using the RemoteUser authentication handler in conjunction
with our campus SSO (Cosign).  I'm trying to replicate our SSO's current
timeouts (4hrs idle, 12hrs hard), with the hope of more predictable session
behavior (and as part of the long time goal to replace RemoteUser +
external SSO with shib native authentication).

I've been looking the comments in idp.properties, and in the wiki,
especially at...
https://wiki.shibboleth.net/confluence/display/IDP30/SessionConfiguration
https://wiki.shibboleth.net/confluence/display/IDP30/AuthenticationConfiguration

In IDPv2, it looks like the recommendation would have been to disable the
IDP sessions completely and let the external SSO handle it (as is suggest
with the Unicon external CAS handler).

In IDPv3, we have "idp.sessions.enabled = true" because we need it to
support the SLO functionality.

These seem like appropriate values..
idp.authn.defaultTimeout=PT4H
idp.authn.defaultLifetime=PT12H
idp.session.defaultSPlifetime = PT12H

My question is re: idp.session.timeout.  In idp.properties, it has the
descriptive comment of "Inactivity timeout", which suggests that our four
hour idle timeout period would be appropriate.

But... the session docs include the comment "IDP session must be at _least_
as long as longest authn result lifetime", which suggests twelve hour
period.

If idp.session.timeout is an inactivity timeout, why must it be at least as
long as the longest authn result lifetime?

Liam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170316/c8f53b16/attachment.html>