Session timeout issue SP 3.0.2

[Ron Harris]

Thank you very much Peter for the reply.

We have a different application which is using same ADFS integration, but
not facing this problem.
So I was thinking that if I am missing something.

I will check the SAML Tracing information tomorrow morning, and check if
there is any difference.


On Mon, Oct 1, 2018 at 1:46 PM Peter Schober <peter.schober at univie.ac.at>
wrote:

> * Ron Harris <neo204011 at gmail.com> [2018-10-01 10:06]:
> > Scenario 1:
> > User tries to access the protected page, he is directed to AFDS page,
> upon
> > successful login he gains access to protected page.
> > After few minutes User closes the brower. Opens the brower back and
> enters
> > the protected page url. he is redirected to ADFS page, but without having
> > to do login, he is directed back to protected page. It seems somehow the
> > username/password was injected to ADFS page.
>
> From the above (SP redirects to IDP) it seems clear the SP session is
> gone but the IDP session still seems to be active, hence you
> experience SSO.
>
> > Scenario 2:
> > User tries to access the protected page after 24 hours. Now it is
> expected
> > that ADFS page be shown to user for login. But now also, the ADFS page is
> > injected with credentials and taken to protected page.
>
> If the SP sends the browser's subject to the IDP then it doesn't have
> an active session. You can see this in detail using the "SAML tracer"
> extension for the Firefox and Chromium/Chrome browsers.
> What happens at the IDP is mostly the IDP's business.
>
> > Please let me know how to make the user enter his credentials again,
> > when times is over for both lifetime and timeout?
>
> Look at your IDP and its sessions and timeouts.
>
> The only thing the SP can do is force re-authentcation every time it
> sends an authn request to the IDP, disabling SSO at the IDP completely
> for logins to this SP. This is likely not what you want.
>
> -peter
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20181001/cc3b9ec2/attachment.html>