timeout settings

[Lohr, Donald]

I am trying to get my head around how SP and IdP timeouts generally work 
and are generally configured.

1. Our IdP is v3.3.3 and looking through the online documentation I see 
reference made to several files that contain lifetime and timeout 
property. Using grep you can see the file and property:

conf/authn/ldap-authn-config.xml 
p:connectTimeout="%{idp.authn.LDAP.connectTimeout:3000}"

	p:blockWaitTime="%{idp.pool.LDAP.blockWaitTime:3000}"

	p:idleTime="%{idp.pool.LDAP.idleTime:600}" />
conf/authn/general-authn.xml 	p:lifetime="PT60S" 
p:inactivityTimeout="PT60S">
conf/idp.properties 	*#idp.session.timeout = PT60M*

	*#idp.session.defaultSPlifetime = PT2H*

	*#idp.authn.defaultLifetime = PT60M*

	*#idp.authn.defaultTimeout = PT30M*

	*#idp.consent.storageRecordLifetime = P1Y*

	*#idp.policy.messageLifetime = PT3M*
conf/ldap.properties 	*#idp.authn.LDAP.connectTimeout = 3000*

	*#idp.pool.LDAP.idleTime = 600*

	*#idp.pool.LDAP.blockWaitTime = 3000*
conf/services.properties 	*#idp.httpclient.connectionTimeout = -1*


Not that properties that I've put in bold (ones that start with #) are 
currently commented out for our IdP.  Is there any user session 
lifetime/timeout in play at all for our environment? Or am I missing 
something?


2. Looking at the SP3 online documentation I see:

lifetime (seconds) [default = 28800 (8 hours)]
     Maximum duration in seconds that a session maintained by the SP 
will be valid. The actual time may be less than this value (if an IdP 
indicates it should be shorter) but will never be longer. Note that this 
will not influence sessions maintained by an application.

timeout    (seconds) [default = 3600 (1 hour)]
     Maximum inactivity allowed between requests in a session maintained 
by the SP. This inactivity applies only to requests to this SP and is 
not aware of activity between the browser and other web sites (or even 
other applications on this system). A value of 0 disables timeout 
checking, but the expiration of the session may be otherwise bounded by 
the cacheAllowance setting on the SessionCache.

cookieLifetime (seconds)
     If set, cookies used for session management will be created with 
the designated lifetime. When omitted, which is the default, such 
cookies are in-memory only and do not persist across browser restarts 
(assuming various session restore features aren't in use). Note that 
this will not affect "transitory" cookies used for maintaining state 
across redirects.

3. We have many hosted (off-prem) SPs, some that are InCommon members 
and others that are not.  If their configuration is not using a 
Shibboleth SP mechanism to protect the SP, I am sure their are lifetime 
and timeout setting somewhere as well, correct?

4. Do any properties exist in the SP's web server itself that controls 
inactivity of the user session?


-- 
D o n a l d   L o h r
  I n f o r m a t i o n   S y s t e m s
  J a m e s   M a d i s o n   U n i v e r s i t y
  5 4 0 . 5 6 8 . 3 7 3 0

  DOS:  Bad command or file name
  bash: command not found

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190620/dc624574/attachment.html>