Shibboleth SP 3 and SubjectConfirmation NotOnOrAfter seems to be ignored

[Cantor, Scott]

On 10/21/18, 1:19 PM, "users on behalf of Michael Nielsen" <users-bounces at shibboleth.net on behalf of michael.nielsen at cedargate.com> wrote:

> If there is not one specified in the AuthnStatement would AuthnInstant+5 minutes be implicit, or would it be up to the
> SP?

The SP.

> If it's up to the SP, then I clearly have timeout="1800" specified in the Sessions element, so I'm not understanding why it
> times-out in 5 minutes.

It wouldn't. If the logs don't say it's timing out, then it's not timing out. Something else is happening. "It redirects" isn't evidence of a timeout, it's simply evidence a session isn't there or isn't valid. There are many possible reasons for that, most of which are logged other than "the cookie's just not there" since that's indistinguishable from first access.

-- Scott