Changing the value of Expires for the IdP session cookie

[Max Spicer]

Thanks for the quick response, Scott.

To give some context, I was investigating this in response to questions
about why some users had to log back in to our Blackboard VLE after
restarting their browser but did not have to log back in to another app.
Both use Shibboleth, but Blackboard appears to use session cookies for its
own sessions, whereas the other app uses cookies with a lifetime of 10
hours. The affected users did not have "on startup, continue where you left
off" (or the equivalent setting) in their browser. Therefore, on browser
restart they lost the link to their session in the VLE and Shibboleth so
had to log in again.

I was asking about shibboleth's session cookie in anticipation of being
asked if we could change Shibboleth to use a cookie with a specified expiry
- for example aligned with idp.session.timeout.

Thanks,

Max

On Wed, 14 Dec 2022 at 13:46, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > Are there any options to change/set the Expires value for the IdP session
> > cookie (shib_idp_session by default) or is this cookie always a "session
> > cookie"?
>
> Always a session cookie, because it has no security implications, it's
> lifetime is only an issue for allowing logout to occur. Getting rid of it
> sooner means less logout success, nothing else.
>
> Again, and I've said this many times, SSO is not based on how long that
> cookie exists.
>
> -- Scott
>
>
>
>
>
>
>

-- 
Max Spicer
Identity Systems, IT Services, University of York
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20221214/8792b612/attachment.htm>