<div dir="ltr">That helps some, but the login handler authentication duration is allegedly set to 8 hours as well:<div><br></div><div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><span class=""> </span><span class=""> </span><span class=""><!-- <br></span> Replace all active login handlers with the following to use the MCB, so that it can handle and/or<br> examine all authentication requests as they come in.<br> --><br><span class=""> </span><span class=""><</span><span class="">ph</span><span class="">:</span><span class="">LoginHandler </span><span class="">xsi</span><span class="">:</span><span class="">type</span><span class="">=</span><span class="">"mcb:MultiContextBroker"</span><span class=""> </span><span class="">authenticationDuration</span><span class="">=</span><span class="">"PT8H0M0.000S"</span><span class=""> </span><span class="">previousSession</span><span class="">=</span><span class="">"true"<br></span><span class=""> </span><span class="">depends-on</span><span class="">=</span><span class="">"mcb.Configuration"</span><span class="">><br></span><span class=""> </span><span class=""><</span><span class="">ph</span><span class="">:</span><span class="">AuthenticationMethod></span><span class="">urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</span><span class=""></</span><span class="">ph</span><span class="">:</span><span class="">AuthenticationMethod><br></span><span class=""> </span><span class=""><</span><span class="">ph</span><span class="">:</span><span class="">AuthenticationMethod></span><span class="">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</span><span class=""></</span><span class="">ph</span><span class="">:</span><span class="">AuthenticationMethod><br></span><span class=""> </span><span class=""><</span><span class="">ph</span><span class="">:</span><span class="">AuthenticationMethod></span><span class="">urn:oasis:names:tc:SAML:2.0:ac:classes:Password</span><span class=""></</span><span class="">ph</span><span class="">:</span><span class="">AuthenticationMethod><br></span><span class=""> </span><span class=""><</span><span class="">ph</span><span class="">:</span><span class="">AuthenticationMethod></span><span class=""><a href="https://iam.alaska.edu/trac/wiki/mfa">https://iam.alaska.edu/trac/wiki/mfa</a></span><span class=""></</span><span class="">ph</span><span class="">:</span><span class="">AuthenticationMethod><br></span><span class=""> </span><span class=""><</span><span class="">ph</span><span class="">:</span><span class="">AuthenticationMethod></span><span class="">urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession</span><span class=""></</span><span class="">ph</span><span class="">:</span><span class="">AuthenticationMethod><br></span><span class=""> </span><span class=""></</span><span class="">ph</span><span class="">:</span><span class="">LoginHandler></span></blockquote>
<blockquote></blockquote><blockquote></blockquote><blockquote></blockquote><blockquote></blockquote><blockquote></blockquote><blockquote></blockquote><blockquote></blockquote><blockquote></blockquote><blockquote></blockquote><blockquote></blockquote>
<div>All other methods in the distributed file commented out.</div><div><br></div><div>David Bantz </div>
</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Jun 14, 2016 at 12:46 PM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">> I've thought we have had 8 hour SSO sessions since the late Pleistocene,<br>
> based on this config in<br>
> ... /conf/internal.xml:<br>
<br>
</span>Neither V2 nor V3 rely on the session lifetime itself for SSO. Individual login methods, handlers, flows, whatever all have their own lifetime and timeout settings that control SSO.<br>
<br>
The IdP session itself can live forever with constant use. Has nothing to do with SSO lifetime.<br>
<span class=""><br>
> But a vendor's SP is keeping a session alive indefinitely by periodically issuing<br>
> SAML request like:<br>
<br>
</span>You can keep a session alive, but you can't bypass the life of the authentication method.<br>
<span class=""><br>
> which my IdP is honoring with previous session handler; here's what I think is<br>
> pertinent log snippet:<br>
<br>
</span><span class="">> [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:478]<br>
> - Basing previous session authentication on active authentication method<br>
> <a href="https://iam.alaska.edu/trac/wiki/mfa" rel="noreferrer" target="_blank">https://iam.alaska.edu/trac/wiki/mfa</a><br>
<br>
</span>If it's active, then it's active. That has nothing to do with the session lifetime.<br>
<span class=""><br>
> I must be missing something. How do I limit the IdP SSO session to 8 hours?<br>
<br>
</span>That's up the login handler(s).<br>
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</font></span></blockquote></div><br></div>