<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif; ">
<div>
<div>
<div>Matthew,</div>
<div><br>
</div>
<div>I'll offer my opinion on this, I'm sure Chad will chime in if I'm way wrong.</div>
<div><br>
</div>
<div>The LoginContext is used during the actual login process, just the amount of time the user spends at the IdP prior to being authenticated. So the amount of time there looks to be an arbitrary value to allow a user to get distracted and still complete authentication.
Also as an influence on it is the amount of time the SAML AuthnRequest is valid for. You want the user to complete authentication while that guy is still in the valid range. Once a user completes authentication, the LoginContext will be cleared since it is
no longer needed/used.</div>
<div><br>
</div>
<div>The Replay Cache entry I would expect to live longer to prevent exactly that scenario, someone re-using the AuthnRequest, either maliciously or not. Most often is a user hitting refresh. I've also seen the problem where a browser will cache what should
not be cached and resubmitting it. So you want that request to stick around in the replay cache until it would time out from the request expiring its life span.</div>
<div><br>
</div>
<div>Paul</div>
<div><br>
</div>
</div>
</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>"Zmuda, Matthew R" <<a href="mailto:Matthew.R.Zmuda@td.com">Matthew.R.Zmuda@td.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>Shibboleth Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Fri, 3 Feb 2012 11:21:24 -0500<br>
<span style="font-weight:bold">To: </span>Shibboleth Users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>Memory Usage<br>
</div>
<div><br>
</div>
<div xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40" xmlns:ns0="urn:schemas-microsoft-com:office:smarttags">
<meta name="Generator" content="Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
p
{mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
<div lang="EN-US" link="blue" vlink="purple">
<div class="Section1">
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial">Hi all,<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial">I’m doing some investigation around memory consumption of shibboleth in our application and had a couple questions:<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial">In HttpServletHelper bindLoginContext a login context entry is added to storage service:<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial">LoginContextEntry entry = new LoginContextEntry(loginContext, 1800000);<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:
12.0pt"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:
12.0pt">Why is timeout value hard coded at
</span></font><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial">1800000? Is there a specific reason for this value?<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:
12.0pt">I’m also noticing when user arrived at IDP, 2 LoginContextEntry and 1 ReplayCacheEntry are added.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:
12.0pt">On the way out only 1 LoginContextEntry is cleared out.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:
12.0pt"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:
12.0pt">My understanding is that after
</span></font><font size="2" face="Arial"><span style="font-size:10.0pt;font-family:Arial">1800000 ms the extra login context entry should clear. And after the configured amount of time in internal.xml the ReplayCacheEntry would be cleared out.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial">Are the ReplayCache and LoginContexctEntry used together? What is the purpose of these sticking around?<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial">I’m hoping to free up memory a quickly as possiblewithout posing security risks.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span style="font-size:10.0pt;
font-family:Arial">Thanks,<o:p></o:p></span></font></p>
</div>
<p><font face="Arial" style="font-size:8pt;"><br>
NOTICE: Confidential message which may be privileged. Unauthorized use/disclosure prohibited. If received in error, please go to www.td.com/legal for instructions.<br>
AVIS : Message confidentiel dont le contenu peut être privilégié. Utilisation/divulgation interdites sans permission. Si reçu par erreur, prière d'aller au www.td.com/francais/avis_juridique pour des instructions.</font></p>
</div>
</div>
-- To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a></span>
</body>
</html>