session timeout confusion

[Cantor, Scott]

> These seem like appropriate values..
> idp.authn.defaultTimeout=PT4H
> 
> idp.authn.defaultLifetime=PT12H
> idp.session.defaultSPlifetime = PT12H

The authn timeouts will determine how often it goes back to the REMOTE_USER source to get the identity, basically. You could just as easily make them really short I think, or even tell the IdP not to persist the record of the authentication result itself via a predicate/condition of false.

> My question is re: idp.session.timeout.  In idp.properties, it has the
> descriptive comment of "Inactivity timeout", which suggests that our four
> hour idle timeout period would be appropriate.

That will act as a cap on how long it could remember a result (and how long it would have data necessary for SLO), but any REMOTE_USER approach is very different in nature and just doesn't have the same results you get from native login in terms of the user's experience.

> If idp.session.timeout is an inactivity timeout, why must it be at least as long
> as the longest authn result lifetime?

Because if the IdP throws away the session, it can't possibly remember the result for as long as you'd be asking it to. The timeout is the upper bound on time between accesses that *could* reuse a result. Again, REMOTE_USER throws all of this into confusion and follows different patterns.

-- Scott