Implementing Canvas Session Timeout

[Scott Cantor]

> We aren't having a problem per se...  but rather our Canvas administrators were wanting us to impose idle and session lengths different from what we have configured in our IdP.  It's my understanding that such per-service settings are expected to be controlled at the SP, not the IdP.

It is physically impossible (absent bizarre polling tricks involving web bugs) for an IdP to have any influence over sessions with an application. There are advice/hints an IdP can send, but they are not enforced by the IdP, only by an SP/application.

This is simply how the web works. Sessions are not global things, they're origin-based because that's how cookies work.

If an application decides to let people stay logged in forever, the only thing that's going to stop that is logout support or literally clearing the browser's state locally.

-- Scott