IdP config parameter for the maximum time of a full authentication

[Wessel, Keith]

Thanks, Scott. We'll up the SLB sticky session time and see what happens. Sure seems like things are timing out before five minutes, but we won't know until we try.

Keith


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Monday, March 18, 2019 10:00 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: IdP config parameter for the maximum time of a full authentication

On 3/18/19, 10:36 AM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

> Add the consent screen to the login process, and logins take a lot 
> longer than they used to when they were only one UI screen long. I 
> know one of the issues causing this is our SLB stickiness which is currently 5 minutes, and I plan to increase that. But it seems like the logins are encountering stale sessions in closer to three minutes.

Java timeout is 30 minutes by default. It's your load balancer.

> Can any of the IdP config params such as idp.policy.messageLifetime 
> which we have set to the default of 3 minutes, also limit the amount of aitme that a user has to get through the login process?

No, nothing does but container session timeout.

-- Scott


--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net