Session timeout issue SP 3.0.2

[Ron Harris]

Hi,

I am working on Shibboleth SP 3.0.2.
I am facing issue with session timeout.
Session configuration is as below:
<Sessions lifetime="3600" timeout="600" relayState="ss:mem"
checkAddress="true" handlerSSL="true" cookieProps="; path=/; HttpOnly">

Scenario 1:
User tries to access the protected page, he is directed to AFDS page, upon
successful login he gains access to protected page.
After few minutes User closes the brower. Opens the brower back and enters
the protected page url. he is redirected to ADFS page, but without having
to do login, he is directed back to protected page. It seems somehow the
username/password was injected to ADFS page.

Scenario 2:
User tries to access the protected page after 24 hours. Now it is expected
that ADFS page be shown to user for login. But now also, the ADFS page is
injected with credentials and taken to protected page.
Please let me know how to make the user enter his credentials again, when
times is over for both lifetime and timeout?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20181001/59e0619a/attachment.html>