Possibility to revoke sessions when using client storage

[David Langenberg]

Rolling all the keys & killing 40,000+ user's SSO sessions because 1 user
got phished and the phisher is aware of the long SSO window is very much
using a nuke to kill a mosquito.  One thing our security folks keep begging
us for is the ability to nuke just one user's SSO session administratively.
We'd be looking for something that supported nuking the client session and
not requiring a stateful connection back to the datastore.  Even if it's a
simple (poll this https://something/nuke.txt file every 5 min) would be good
enough.

Dave

--
David Langenberg
Asst Director, Identity Management
The University of Chicago

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Friday, March 30, 2018 11:03 AM
To: Philip Brusten <philip.brusten at kuleuven.be>; Shib Users
<users at shibboleth.net>
Subject: RE: Possibility to revoke sessions when using client storage

> This could be problematic for longlived sessions. Shall I submit a 
> feature request for this?

I think it's up to applications to do authz and not rely on authentication,
but like anything else it's  a matter of finding time. With the IdP I think
it's just not that big a deal to roll the keys and invalidate everybody. All
that does is cause people to have to login the next time they interact. Not
really that big a deal in practice.

-- Scott

--
For Consortium Member technical support, see
https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5694 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20180402/953eaa10/attachment.p7s>