<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:10pt"><div>Hi,</div><div><br></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;">I am at the Shibboleth IDP end and am doing SSO with a cloud Service Provider. It is using <span style="background-color: transparent;">Un-solicitated (IDP initiated) SSO where users authenticate (using LDAP Active Directory) at my site and then are re-directed to Service Provider. When user log-out from Service Provider, their SP session is terminated and browser is re-directed to my Shibboleth logout page (/userProfile/Logout) wherein I </span><span style="font-size: 10pt;">remove the _idp_session and 'JSESSIONID' cookies</span><span style="font-size:
10pt;"> and </span><span style="background-color: transparent;">invalidate the session. </span></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span style="background-color: transparent;"><br></span></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span style="background-color: transparent;">Does it look like a typically Un-solicitated SSO flow or am I missing something? Is there any other clean-up/graceful resource release that should be done?</span></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style:
normal;"><span style="background-color: transparent;"><br></span></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;">What factors I should consider to arrive at various session timeouts? On an average, users stay at the SP site for about 10 minutes. </div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span style="font-size: 10pt;">To begin with, I have configured both my web application (web.xml session-timeout) and Shibboleth IDP (</span><span
style="font-size: 10pt;">shibboleth.SessionManager constructor argument in internal.xml and LoginHandler authenticationDuration in handler.xml</span><span style="font-size: 10pt; background-color: transparent;">) session time out to 20 minutes. I have a feeling that these two should usually match. </span></div><div style="color: rgb(0, 0, 0); font-size: 10pt; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span style="background-color: transparent; font-size: 10pt;"><br></span></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span style="background-color: transparent; font-size: 10pt;">Should I ask SP to configure their session-timeout to also 20 minutes? </span></div><div style="color:
rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;">Are their any guidelines for arriving at session timeout in such Un-solicitated SSO cases? Should all the three match? Or, do the two timeouts at my end be larger than the Vendor SP timeout? </div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent;
font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;">Thanks,</div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;">Ajay </div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span style="background-color: transparent;"><br></span></div><div style="color: rgb(0, 0, 0); font-size: 13px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span style="background-color: transparent;">
</span></div></div></body></html>