Maintain application session duration same as that of IDP while signing in through Shibboleth

[Cantor, Scott]

> We thought if we can extract the IssueInstant, NotBefore and
> NotOnOrAfter present in the IDP SAML response and by
> some means send the same to our application through the
> Shib attributes. Is this approach possible?

It's neither possible nor appropriate. Those settings have nothing to do with this topic. They're generally set to maybe a 5 minute window anyway, you'd be expiring sessions right after they started.

> If the NotOnOrAfter attribute is just an advisory from IDP,

SessionNotOnOrAfter. That is not the same as NotOnOrAfter.

> and if there is a separate setting that each IDP has, how can
> we get the setting value configured for IDP and bring it to the
> application and use it configure the application session
> duration?

If you want to know how to configure a Shibboleth IdP to send it, search the wiki.

-- Scott