timeout settings

[Cantor, Scott]

On 6/20/19, 1:46 PM, "users on behalf of IAM David Bantz" <users-bounces at shibboleth.net on behalf of dabantz at alaska.edu> wrote:

> I didn't know this. Can you provide hints on where in Shibb documentation to find more about this ability - or potentially
> blocking SSO itself by IP address for labs?

The reuseCondition property of the AuthenticationFlowDescriptor objects in general-authn.xml governs reuse of a method regardless of timeouts or any other criteria. It was put there partly for other reasons but a side effect is that it makes all of it dynamically controllable.

The ForceAuthn flag is also overrideable now by profile configuration / relying party, which means it's also pluggable with a strategy function that can make decisions based on more than just the service if it has to. I'll have to see if I updated the profile configuration summaries that mention a lot of the common options with that.

On top of that the MFA scripting engine has full control anyway so it can forcibly do whatever it wants in the end.

-- Scott