<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Also, mostly for the archives, this could hypothetically happen if the IdP is sending back incorrect RelayState values. I think that's explicitly prohibited by the specification but it's certainly not out of the realm of imagination if the IdP session is timing
out but the IdP is willing to treat it as an unsolicited SSO request.
<div><br>
</div>
<div>Sending the user to an SP-designated URL is a protection mechanism. The inability to perform this check is one of the drawbacks of IdP-initiated SSO, so I would leave it in place if you can.</div>
<div><br>
</div>
<div><a href="https://issues.oasis-open.org/browse/SECURITY-12">https://issues.oasis-open.org/browse/SECURITY-12</a><br>
<div><br>
</div>
<div>
<div>
<div>
<div>On Jul 7, 2014, at 6:42 PM, Nate Klingenstein <ndk@internet2.edu></div>
<div> wrote:</div>
<br class="Apple-interchange-newline">
<blockquote type="cite">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
Jo,
<div><br>
</div>
<div>The behavior you're experiencing is because the SP is losing the page that the user had been on a long, long time ago in a place far, far away. That can be persisted in a couple of ways.</div>
<div><br>
</div>
<div><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPStorageService">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPStorageService</a></div>
<div><br>
</div>
<div>Ultimately, the SP needs to know where to send the user upon receipt of a valid assertion, and that's either "default" or "where I told myself they came from". I think the easiest way to do that in your situation is just changing the timeout. </div>
<div><br>
<div>
<blockquote type="cite">
<div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-indent: -0.25in; ">
<span>1.<span style="font-style: normal; font-variant: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman'; "> <span class="Apple-converted-space"> </span></span></span>If I set session timeout to 0 will the
user be able to log in up to the session lifetime?</div>
</blockquote>
<div><br>
</div>
<div>From the docs at </div>
<div><br>
</div>
<div><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions</a></div>
<div>
<ul style="margin: 10px 0px 0px; color: rgb(51, 51, 51); font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; background-color: rgb(255, 255, 255); ">
<li><code>timeout</code>(time in seconds) (default is 3600)
<ul style="margin: 0px; list-style-type: disc;">
<li>Maximum inactivity allowed between requests in a session maintained by the SP. This inactivity applies only to requests to this SP and is not aware of activity between the browser and other web sites (or even other<a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplication" style="color: rgb(50, 96, 186); text-decoration: none;">applications</a> on
this system). A value of 0 disables timeout checking.</li></ul>
</li></ul>
<div><br>
</div>
</div>
<br>
<blockquote type="cite">
<div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-indent: -0.25in; ">
<o:p></o:p></div>
<div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; text-indent: -0.25in; ">
<span>2.<span style="font-style: normal; font-variant: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman'; "> <span class="Apple-converted-space"> </span></span></span>Is there any way to handle this differently,
like redirect to some URL?<o:p></o:p></div>
</blockquote>
</div>
</div>
<div><br>
</div>
<div>You can set the homeURL to anything you would like through a variety of mechanisms. You can also set an explicit target URL. There are other storage mechanisms. Searching the Wiki for "homeurl" will give you some starting points.</div>
<div><br>
</div>
<div>Hope this helps,</div>
<div>Nate.</div>
</div>
--<br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net</blockquote>
</div>
<br>
</div>
</div>
</div>
</body>
</html>