<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Hello,<br><br>Following is our environment<br>- Shibboleth-SP 2.5<br>- Apache 2.2<br><br>The client has an IdP that is sending the below <samlp:Response> as part of an IdP initiated SSO usecase<br><br> <saml:Subject><br> <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName">PRINCIPAL_NAME</saml:NameID><br> <saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><br> <saml:SubjectConfirmationData NotOnOrAfter="2013-03-20T12:01:14Z"<br> Recipient="https://MyHost/Shibboleth.sso/SAML2/POST"/><br> </saml:SubjectConfirmation><br> </saml:Subject><br> <saml:Conditions NotBefore="2013-03-20T11:36:14Z" NotOnOrAfter="2013-03-20T12:01:14Z"><br> <saml:AudienceRestriction><br> <saml:Audience>SampleAudienceName</saml:Audience><br> </saml:AudienceRestriction><br> </saml:Conditions><br> <saml:AuthnStatement AuthnInstant="2013-03-20T11:46:13Z" SessionIndex="id-123456789"<br> SessionNotOnOrAfter="2013-03-20T11:46:24Z"><br> <saml:AuthnContext><br> <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos</saml:AuthnContextClassRef><br> </saml:AuthnContext><br> </saml:AuthnStatement><br><br>What we are noticing is that the SP expires the session after a few minutes after authenticating the user. It follows the expected flow by trying to point to the location specified in the IdP's metadata under Location attribute for md:SingleSignOnService element. We understand this is default behavior.<br><br>We understand various time restrictions in above message as below<br>-- saml:Conditions = Grant access to the user only in between the NotBefore and NotOnOrAfter time<br>-- saml:AuthnStatement = Create a session only between the AuthnInstant and SessionNotOnOrAfter<br><br>As we see in the logs, SP expires the session at 2013-03-20 11:54:20. If the session is being removed because the time period specified by IdP has passed we would expect it to do after 2013-03-20T12:01:14Z. Would appreciate if someone can point out why the SP expires before the expiry time set by the IdP? <br><br>Following are the Application defaults for the SP<br><br> <ApplicationDefaults entityID="MySPEntityID" REMOTE_USER="eppn"><br><br> <Sessions lifetime="28800" timeout="3600" checkAddress="false" <br> handlerURL="/Shibboleth.sso" handlerSSL="true" cookieProps="https" relayState="ss:mem"<br> exportLocation="http://localhost/Shibboleth.sso/GetAssertion" exportACL="127.0.0.1" ><br><br><br>Thanks<br>Ragadeep<br> </div></body>
</html>