Shibboleth SP 3 and SubjectConfirmation NotOnOrAfter seems to be ignored

[Michael Nielsen]

Thank you, Scott.

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Friday, October 19, 2018 9:32 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Shibboleth SP 3 and SubjectConfirmation NotOnOrAfter seems to be ignored

> Under what circumstances does Shibboleth SP (apparently) not observe the SubjectConfirmation’s NotOnOrAfter?

None. It applies to intial processing of the assertion, nothing more. I would suspect perhaps you're dealing with an IdP setting SessionNotOnOrAfter which has a totally different meaning and bounds the SP session.
 
> What mechanism determines the number of idle minutes?

The timeout.
 
-- Scott



-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net