timeout settings

[Cantor, Scott]

On 6/20/19, 11:05 AM, "users on behalf of Lohr, Donald" <users-bounces at shibboleth.net on behalf of lohrda at jmu.edu> wrote:

> I am trying to get my head around how SP and IdP timeouts generally work and are generally configured.

In most cases, whoever's asking doesn't know how to ask what they really want to know, and the usual answer to what they really need to know is "don't use shared machines, lock desktops, and move on".

> Not that properties that I've put in bold (ones that start with #) are currently commented out for our IdP. 

Commented properties are by and large defaults. They're set to whatever the comment is. That's standard config file practice, it allows defaults to be changed more easily on upgrades when there's a need.

> 3. We have many hosted (off-prem) SPs, some that are InCommon members and others that are not.  If their
> configuration is not using a Shibboleth SP mechanism to protect the SP, I am sure their are lifetime and timeout setting
> somewhere as well, correct?

Possibly, or their sessions are semi-permanent, which is how most of the modern world sees this stuff. Many cloud systems are designed around what consumers expect, not what enterprises want. And what some enterprises want is a mainframe, and the web isn't one.

> 4. Do any properties exist in the SP's web server itself that controls inactivity of the user session?

Not in general, but sometimes application sessions can be controlled that way in cases like Java containers.

-- Scott