<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><div style="direction: inherit;">Say that the IDP authn timeout is 60m and SP timeout is also 60 m but simce SP uses sliding window concept say it uses the application after 45 mins from its session login.. the session must be valid till after 45+60 mins and when the user at 75 mins after the original login tries to switch SP it will be redirected to IDP login page whereas the user would ideally want to be logged in on switching the sp. </div><div style="direction: inherit;"><br></div><div style="direction: inherit;"><br></div><div style="direction: inherit;">So what configuration changes must beade to make something like this work</div><div style="direction: inherit;"><br></div><div style="direction: inherit;">Thanks for the help</div></div><div><br>On 06-Oct-2016, at 9:12 PM, Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br><br></div><blockquote type="cite"><div><blockquote type="cite"><span>idp.session.timeout is by default 60m..what security and resource issues are</span><br></blockquote><blockquote type="cite"><span>most likely to happen when i increase the timeout to say 24h.</span><br></blockquote><span></span><br><span>I couldn't give you numbers no matter what, I don't have them, but that depends on the storage strategy involved. Storing data on the client doesn't impose much of any impact on the server. Otherwise it has very obvious impacts. That's one of many reasons why I use the client.</span><br><span></span><br><blockquote type="cite"><span>idp.authn.defaultlifetime=PT60M</span><br></blockquote><blockquote type="cite"><span>idp.authn.defaultTimeout=PT30M</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>similarly what security and resource based problems am i most likely to</span><br></blockquote><blockquote type="cite"><span>encounter on increasing the defualtlifetime to say 8hrs and defaultimeout</span><br></blockquote><blockquote type="cite"><span>accordingly.</span><br></blockquote><span></span><br><span>Same answer, plus obviously increased security risk if you think SSO is a risk. That's a personal decision.</span><br><span></span><br><blockquote type="cite"><span>If Suppose IDP is configured such that idp.authn.defaultTimeout is 60</span><br></blockquote><blockquote type="cite"><span>minutes while the idp.authn.defaultLifetime is 120 min, SP session timeout is</span><br></blockquote><blockquote type="cite"><span>120 minutes. There is only activity at front channel at SP but no back end</span><br></blockquote><blockquote type="cite"><span>channel activity. Then after 60 minutes,IDP timeout will occur due to</span><br></blockquote><blockquote type="cite"><span>inactivity but SP session is still valid and then suppose SP redirects to SP2</span><br></blockquote><blockquote type="cite"><span>after 90 mins from initial login time which follows the same SSO settings so it</span><br></blockquote><blockquote type="cite"><span>will then not get authenticated and get redirected to IDP login page. How can</span><br></blockquote><blockquote type="cite"><span>i manage the session configuration so as to avoid such conditions without</span><br></blockquote><blockquote type="cite"><span>compromising on security??</span><br></blockquote><span></span><br><span>I don't know what you're asking. The scenario there is that the second request to the IdP is 90 minutes after the first, and you said the authn timeout is 60 minutes, so that means it will be timed out and the second request will repeat authentication again. If that's not what you want, change the numbers.</span><br><span></span><br><span>-- Scott</span><br><span></span><br><span>-- </span><br><span>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></span><br></div></blockquote></body></html>