<div dir="ltr">My idp V 3.2.1 is expiring SSO sessions more quickly than I thought I had configured in .../conf/idp.properties:<div><br></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"></blockquote></div></blockquote><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><span class="gmail-s1">idp.authn.defaultLifetime</span><span class="gmail-s2"> = </span><span class="gmail-s3">PT10H</span><br><blockquote class="gmail_quote" style="margin:0px 0.8ex;border-left:1px solid rgb(204,204,204);border-right:1px solid rgb(204,204,204);padding-left:1ex;padding-right:1ex"></blockquote><span class="gmail-s1">idp.authn.defaultTimeout</span><span class="gmail-s2"> = </span><span class="gmail-s3">PT8H</span><br><blockquote class="gmail_quote" style="margin:0px 0.8ex;border-left:1px solid rgb(204,204,204);border-right:1px solid rgb(204,204,204);padding-left:1ex;padding-right:1ex"></blockquote><span class="gmail-s1"># Inactivity </span><span class="gmail-s2">timeout</span><br><span class="gmail-s1">#idp.session.</span><span class="gmail-s2">timeout</span><span class="gmail-s1"> = PT8H </span></div></blockquote><div>








<p class="gmail-p1">








</p><p class="gmail-p1">But logins to relying parties challenge for authN within about 3 hours. (Verified this on a client with single wired network connection with fixed IP, after verifying expected longer-lived SSO session on still running V2 IdP).</p><p class="gmail-p1">I find this additional reference to idp timeout in session-manager-system.xml</p></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><span class="gmail-s1">   </span><span class="gmail-s2"><bean </span><span class="gmail-s3">id</span><span class="gmail-s1">=</span><span class="gmail-s4">"shibboleth.SessionManager"</span><span class="gmail-s2"> </span><span class="gmail-s3">class</span><span class="gmail-s1">=</span><span class="gmail-s4">"net.shibboleth.idp.session.impl.StorageBackedSessionManager"<br></span></div><div><span class="gmail-s2">            </span><span class="gmail-s3">depends-on</span><span class="gmail-s1">=</span><span class="gmail-s4">"shibboleth.OpenSAMLConfig"<br></span></div><div><span class="gmail-s2">            ...</span></div><div><span class="gmail-s2">            </span><span class="gmail-s3">p</span><span class="gmail-s5">:</span><span class="gmail-s3">sessionTimeout</span><span class="gmail-s1">=</span><span class="gmail-s4">"%{idp.session.</span><span class="gmail-s6">timeout</span><span class="gmail-s4">:PT60M}"</span></div><div><span class="gmail-s4"><br></span></div></blockquote>Is that the correct place to extend SSO session lifetime ?  <div>Will I need to rebuild the IdP for a change to take effect?<br><div><p class="gmail-p1">















</p></div></div><div>David Bantz</div></div>