Reg: Maintain application session duration same as that of IDP while signing in through Shibboleth

[Viswanathan, Srinivasan (ELS-CON)]

Dear Team,

We have an application that has sign-in feature through Shibboleth redirecting to IDPs for authentication. We are having a scenario where the application maintains session with duration greater than the duration maintained by the IDP session. From security prespective, some of the IDPs are a bit concerned about this and they want us to maintain the session duration same as that of the IDP session duration.

We have been trying to explore the possibility of the same. We were trying to check if there are already available shibboleth attributes containing the IDP session duration that we could make use of in setting the application session duration. However, we were not able to find such an attribute as of now. When we tried to go-through the SAML response for IDP, we came across IssueInstant, NotBefore, NotOnOrAfter parameters highlighted below in the response. We are of the opinion that the IssueInstant is the creation time of the IDP session and the NotBefore and NotOnOrAfter contains the timestamps during which the IDP session will be valid. We wanted to know if our understanding is correct and if the above-mentioned parameters will be available in the SAML response for all IDPs so that we can make use of them. PFB extract from sample SAML response. Requesting your support. Please let us know if any additional detail is needed.

<Assertion ID="_47bd74a2-b0b6-48b8-9023-72871cdb8dc6" IssueInstant="2024-08-08T09:32:37.531Z" Version="2.0" xmlns="urn:oasis:names:tc:SAML:2.0:assertion">
        <Issuer>
           AAAAAAAAAAAAAAAAAAAAAAAAAAA
        </Issuer>
        <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
            <ds:SignedInfo>
                <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
                <ds:Reference URI="######################">
                    <ds:Transforms>
                        <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
                        <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
                    </ds:Transforms>
                    <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
                    <ds:DigestValue>
                        AAAAAAAAAAAAAAAAAAAAAAAAAA
                    </ds:DigestValue>
                </ds:Reference>
            </ds:SignedInfo>
            <ds:SignatureValue>

            </ds:SignatureValue>
            <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
                <ds:X509Data>
                    <ds:X509Certificate>

                    </ds:X509Certificate>
                </ds:X509Data>
            </KeyInfo>
        </ds:Signature>
        <Subject>
            <NameID Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent">

            </NameID>
            <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer">
                <SubjectConfirmationData InResponseTo="xxxxxxxxxxxxxxxxxxx" NotOnOrAfter="2024-08-08T09:37:37.546Z" Recipient=""/>
            </SubjectConfirmation>
        </Subject>
        <Conditions NotBefore="2024-08-08T09:32:37.531Z" NotOnOrAfter="2024-08-08T10:32:37.531Z">
            <AudienceRestriction>
                <Audience>

                </Audience>
            </AudienceRestriction>
        </Conditions>
        <AttributeStatement>
            <Attribute Name="urn:oid:0.9.2342.19200300.100.1.3" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
                <AttributeValue>
                    XXXXXXXXX
                </AttributeValue>
            </Attribute>
            <Attribute Name="urn:oid:2.5.4.42" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
                <AttributeValue>
                    YYYYYYYYY
                </AttributeValue>
            </Attribute>
            <Attribute Name="urn:oid:2.5.4.4" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
                <AttributeValue>
                    ZZZZZZZZ
                </AttributeValue>
            </Attribute>
        </AttributeStatement>
        <AuthnStatement AuthnInstant="2024-08-08T09:32:37.515Z" SessionIndex="_47bd74a2-b0b6-48b8-9023-72871cdb8dc6">
            <AuthnContext>
                <AuthnContextClassRef>
                    urn:federation:authentication:windows
                </AuthnContextClassRef>
            </AuthnContext>
        </AuthnStatement>
    </Assertion>

Thanks and regards,
V. Srinivasan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240809/0fdc8684/attachment.htm>