Shibboleth SP 3 and SubjectConfirmation NotOnOrAfter seems to be ignored

[Michael Nielsen]

So I looked again at my Sessions element for this SP:

<Sessions lifetime="28800" timeout="1800" relayState="cookie"  checkAddress="false" handlerSSL="true" cookieProps="https">

The timeout is 1800, which I calculate as roughly 30 minutes.

Is this the timeout to which you refer?  I'm guessing not, since I'm pretty sure I get at most 5 minutes of inactivity before being 302'd back to the IdP.

Where would the timeout you describe be set?

Thank you again.

Regards,

Mike

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Friday, October 19, 2018 9:32 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Shibboleth SP 3 and SubjectConfirmation NotOnOrAfter seems to be ignored

> Under what circumstances does Shibboleth SP (apparently) not observe the SubjectConfirmation’s NotOnOrAfter?

None. It applies to intial processing of the assertion, nothing more. I would suspect perhaps you're dealing with an IdP setting SessionNotOnOrAfter which has a totally different meaning and bounds the SP session.
 
> What mechanism determines the number of idle minutes?

The timeout.
 
-- Scott



-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net