Maintain application session duration same as that of IDP while signing in through Shibboleth

[Viswanathan, Srinivasan (ELS-CON)]

Dear Scott,

Our requirement is to get the IDP session expiry/duration details from IDP and set the same duration for our application session.

We thought if we can extract the IssueInstant, NotBefore and NotOnOrAfter present in the IDP SAML response and by some means send the same to our application through the Shib attributes. Is this approach possible?

If the NotOnOrAfter attribute is just an advisory from IDP, and if there is a separate setting that each IDP has, how can we get the setting value configured for IDP and bring it to the application and use it configure the application session duration?

Thanks and regards,
V. Srinivasan
________________________________
From: Cantor, Scott <cantor.2 at osu.edu>
Sent: Wednesday, August 14, 2024 6:16 PM
To: Viswanathan, Srinivasan (ELS-CON) <s.viswanathan1 at elsevier.com>; Shib Users <users at shibboleth.net>
Cc: Dorminvil, Marc (ELS-LOW) <m.dorminvil at elsevier.com>; Maduskar, Bhupesh (ELS-CON) <b.maduskar at elsevier.com>
Subject: Re: Maintain application session duration same as that of IDP while signing in through Shibboleth

[You don't often get email from cantor.2 at osu.edu. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]

*** External email: use caution ***



> However, considering the number of IDPs, it would be
> difficult to obtain the setting from each IDP and set the
> application session duration right?

There is only ever one IdP involved with a given session, and if it sends a value for SessionNotOnOrAfter, then it's honored. Not sure what you're asking though.

-- Scott


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240814/cdfa96bb/attachment.htm>