Another query out of left field: extending the session timeout indefinitely for E911 VOIP service

[Florian Lengyel]

-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu> 
Sent: Friday, February 3, 2023 1:14 PM
To: Shib Users <users at shibboleth.net>
Cc: Florian Lengyel <Florian.Lengyel at cuny.edu>
Subject: Re: Another query out of left field: extending the session timeout indefinitely for E911 VOIP service

***ATTENTION: This email came from an external source. Do not open attachments or click on links from unknown senders or unexpected emails.***


>If you're talking about the IdP, it is not true that the IdP is responsible for anything expiring, because session lifetime at an SP is dependent on the SP, not the IdP. It lasts as long as the SP wants it to.

Thank you--very helpful. The VOIP phone would be the SP in this case. 

I was confused somewhat by what Microsoft was telling me, since the session timeout at the IdP is 60M.
I saw nothing about a 24H timeout, e.g., in idp.properties I have the default
# Inactivity timeout
#idp.session.timeout = PT60M
Elsewhere there are no references to a 24H timeout.

>> I write to ask if Shibboleth/SAML2 handles periodic authentication of 
>> online devices in some way.

>The IdP's entire function is periodic authentication of online devices. That's literally what SAML does. So whatever you mean probably isn't what I would interpret that to mean.

>-- Scott

OK -- periodic re-authentication of say phones without user intervention. 
 SAML does this, or some specific feature within the SAML specification, such as ECP?

The fact is I don't know exactly what I mean. This is partly because I've been 
dropped in the middle of someone's experiment.

Thanks again,

Florian