<div dir="ltr">I've thought we have had 8 hour SSO sessions since the late Pleistocene, based on this config in <br>



   ... /conf/internal.xml:<div><br></div><div><div style="font-size:12.8px"><div><bean id="shibboleth.SessionManager" class="edu.internet2.middleware.shibboleth.idp.session.impl.SessionManagerImpl" depends-on="shibboleth.LogbackLogging"></div><div>        <constructor-arg ref="shibboleth.StorageService"/></div><div>        <constructor-arg value="28800000" type="long"/></div><div>    </bean></div></div><div class="" style="margin:2px 0px 0px;font-size:12.8px"><div id=":1oj" class="" tabindex="0"><img class="" src="https://ssl.gstatic.com/ui/v1/icons/mail/images/cleardot.gif"></div><div id=":1oj" class="" tabindex="0">But a vendor's SP is keeping a session alive indefinitely by periodically issuing SAML request like:</div><div id=":1oj" class="" tabindex="0"><br></div><div id=":1oj" class="" tabindex="0"><blockquote class="gmail_quote" style="font-size:12.8px;margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><font face="monospace, monospace" size="1">07:52:36.443 - DEBUG [PROTOCOL_MESSAGE:113] - <br><?xml version="1.0" encoding="UTF-8"?><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" AssertionConsumerServiceURL="<a href="https://www.getrave.com/Shibboleth.sso/SAML2/POST" target="_blank">https://www.getrave.com/Shibboleth.sso/SAML2/POST</a>" Destination="<a href="https://idp.alaska.edu/idp/profile/SAML2/Redirect/SSO" target="_blank">https://idp.alaska.edu/idp/profile/SAML2/Redirect/SSO</a>" ID="_1f3710c222e5e9cac6121886423704dd" IssueInstant="2016-06-14T15:52:36Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0"><br>   <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><a href="https://www.getrave.com/shibboleth-sp" target="_blank">https://www.getrave.com/shibboleth-sp</a></saml:Issuer><br>   <samlp:NameIDPolicy AllowCreate="1"/><br></samlp:AuthnRequest></font></blockquote><div><font face="monospace, monospace" size="1"><br></font></div><div><font face="monospace, monospace" size="1">which my IdP is honoring with previous session handler; here's what I think is pertinent log snippet:</font></div><div><font face="monospace, monospace" size="1"><br></font></div><div><div style="font-size:12.8px"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><font face="monospace, monospace"><font size="1"> </font><span style="font-size:x-small">00:22:36.597 - DEBUG [edu.internet2.middleware.shibboleth.common.relyingparty.provider.SAMLMDRelyingPartyConfigurationManager:157] - No custom or group-based relying party configuration found for<a href="https://www/" target="_blank">https://www</a>.</span><span style="font-size:x-small">getrave</span><span style="font-size:x-small">.com/shibboleth-sp. Using default relying party configuration.<br></span><span style="font-size:x-small">00:22:36.597 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:226] - Creating login context and transferring control to authentication engine<br></span><span style="font-size:x-small">00:22:36.598 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:181] - Storing LoginContext to StorageService partition loginContexts, key 899a272afc03b832c9cbdc8543c6fd876f6fa52400fd8b1928b9bc89ef9fc4d5<br></span><span style="font-size:x-small">00:22:36.598 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:240] - Redirecting user to authentication engine at <a href="https://idp.alaska.edu/idp/AuthnEngine" target="_blank">https://idp.alaska.edu:443/idp/AuthnEngine</a><br></span><span style="font-size:x-small">00:22:36.604 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:209] - Processing incoming request<br></span><span style="font-size:x-small">00:22:36.605 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:240] - Beginning user authentication process.<br></span><span style="font-size:x-small">00:22:36.605 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:244] - Existing IdP session available for principal dabantz<br></span><span style="font-size:x-small">00:22:36.605 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:283] - Filtering configured LoginHandlers: {urn:oasis:names:tc:SAML:2.0:ac:classes:Password=edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler@74c9a375, urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession=edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler@74c9a375, urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified=edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler@74c9a375, <a href="https://iam.alaska.edu/trac/wiki/mfa=edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler@74c9a375" target="_blank">https://iam.alaska.edu/trac/wiki/mfa=edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler@74c9a375</a>, urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport=edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler@74c9a375}<br></span><span style="font-size:x-small">00:22:36.605 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:464] - Selecting appropriate login handler from filtered set {urn:oasis:names:tc:SAML:2.0:ac:classes:Password=edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler@74c9a375, urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession=edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler@74c9a375, urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified=edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler@74c9a375, <a href="https://iam.alaska.edu/trac/wiki/mfa=edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler@74c9a375" target="_blank">https://iam.alaska.edu/trac/wiki/mfa=edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler@74c9a375</a>, urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport=edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler@74c9a375}<br></span><font size="1">00:22:36.605 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:467] -</font><b> Authenticating user with previous session LoginHandler</b><br><span style="font-size:x-small">00:22:36.605 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:478] - Basing previous session authentication on active authentication method <a href="https://iam.alaska.edu/trac/wiki/mfa" target="_blank">https://iam.alaska.edu/trac/wiki/mfa</a><br></span><span style="font-size:x-small">00:22:36.606 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginHandler:91] - MCBConfiguration bean = [edu.internet2.middleware.assurance.mcb.authn.provider.MCBConfiguration@1a2f9dd]</span></font></blockquote></div><div style="font-size:12.8px"><br></div></div><div style="font-size:12.8px">I must be missing something. How do I limit the IdP SSO session to 8 hours?</div><div style="font-size:12.8px"><br></div><div style="font-size:12.8px">David Bantz</div><div><font face="monospace, monospace" size="1"><br></font></div><div><font face="monospace, monospace" size="1"><br></font></div></div></div></div></div>