Reducing the number of re-authentications

[Tax, Jan]

Hello,

The Information Security Office at UNC-CH is interested in reducing the number of times that users are prompted for a password when authenticating to our Shibboleth IdP (v3.4). We currently have a 13-hour IdP session lifetime, a 30-minute IdP inactivity timeout. The majority of our on-campus SPs are using default values.

We are interested in finding out how other institutions have configured SP and IdP settings for session lifetime, inactivity timeout, and the Duo “remember me” time. I will summarize the responses I receive and post back to the group.

About 6% of our authentications are due to IP address changes. We’re looking at ignoring IP address changes that are within UNC IP address space, if possible. Does the Shibboleth IdP support some kind of filter or predicate for that check?

If this has been covered before, pointers to those discussions are also appreciated.

Thanks in advance,
Jan
--
Johannes (Jan) Tax
ITS Identity Management
University of North Carolina at Chapel Hill
+1 919 962 5642
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190307/4ab85028/attachment.html>