Differential Timeouts with like IdPs?

[Peter Schober]

* Michael Gettes <gettes at ufl.edu> [2020-01-28 23:03]:
> I access an SP-X via my IdP-Home and I receive a default session of 10H and an idle timeout of 10H.
> I then go to access SP-AAL3 and because I am a user in ldap group AAL3 my IdP-Home sees
> I am accessing SP-AAL3 and sets my idle timeout to 30M.  This appears to not be possible now???

I think Ray's reply hints at keeping SP-AA3's sessions and business
within that SP, and not trying to messing up the subject's IDP session
based on a singular SP's opinion.
The SP has ways of finding out when the initial authn happened at the
IDP (included in the IDP's last response that itself may have been
based on SSO, not authn) so if the SP cared it could always decide to
treat not accept that login, e.g. by sending the IDP another authn
request, this time with forced authn set, or whatever.

> I realize I could have SP-AAL3 be bound to another IdP-AAL3 like my
> IdP-Home but with different idle timeout config of 30M but this
> would involve an additional SSO sign-on - which would annoy my
> users.  But, if I configured IdP-AAL3 to be just like IdP-Home (same
> keys and crypto for cookies) and SP-AAL3 was configured to only use
> IdP-AAL3 - would I not still get a SSO experience for my users
> without the additional sign-on event?  Would this get me an idle
> timeout to 30M going forward for all interactions with SP-AAL3 and
> 10H for all SPs associated with IdP-Home?  Has anyone done this?

You mean restoring an IDP session using client-side state across
completely different IDPs (hostname, endpoints, entityID)?
The browser wouldn't share any of its state with another host?

> I am trying to keep the scenario as simple as possible.  If this is
> not possible right now, what would It take to make this possible?

I think going back a step and looking at what made you consider
shortening the IDP's session based on the subject being in a specific
group and having accessed a specific SP would be helpful.
(That last part sounds a bit arbitrary to me.)

Best,
-peter