<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hi Scott,</p>
<p>please excuse me for answering so late on this SLO thread, there
has been both a timezone lag and a vacation lag. Let me get back
to this. Here is what my Session timeouts and lifetimes are set
to:</p>
<p>grep PT idp.properties|grep -v '#'<br>
idp.session.timeout = PT8H<br>
idp.session.slop = PT4H<br>
idp.session.defaultSPlifetime = PT8H<br>
idp.authn.defaultLifetime = PT8H<br>
</p>
<p>My suspicion is that the idp.session.timeout = PT8H (the
inactivity timeout) is not being honored, see "
inactivityTimeout=1800000" in this log snippet:<br>
</p>
<p>2017-06-21 10:59:52,396 - DEBUG
[org.springframework.webflow.execution.repository.impl.DefaultFlowExecutionRepository:121]
- Putting flow execution '[FlowExecutionImpl@293cf92c flow =
'SAML2/Redirect/SSO', flowSessions =
list[[FlowSessionImpl@29fc819f flow = 'SAML2/Redirect/SSO', state
= 'DoAuthenticationSubflow', scope = map[[empty]]],
[FlowSessionImpl@310ce85a flow = 'authn', state =
'CallAuthenticationFlow', scope = map['calledAsSubflow' ->
true, 'calledAsExtendedFlow' -> [null]]],
[FlowSessionImpl@2563ce16 flow = 'authn/MFA', state =
'CallSubflow', scope = map['calledAsSubflow' -> true,
'calledAsExtendedFlow' -> [null], 'mfaContext' ->
net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext@e770f9]],
[FlowSessionImpl@6b58a60f flow = 'authn/Password', state =
'DisplayUsernamePasswordPage', scope = map['calledAsSubflow' ->
true, 'viewScope' -> map[[empty]], 'calledAsExtendedFlow' ->
[null], 'thisFlow' ->
AuthenticationFlowDescriptor{flowId=authn/Password,
supportsPassive=true, supportsForcedAuthentication=true,
lifetime=28800000,<b> inactivityTimeout=1800000</b>}]]]]' into
repository<br>
</p>
<p>What could be the problem here?</p>
<p>Regards</p>
Martin<br>
<div class="moz-cite-prefix">On 02.06.2017 15:46, Cantor, Scott
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:77218724-DFB2-48F3-A99C-240E7ED9BBD8@osu.edu">
<pre wrap="">I guess a caveat since you mentioned something about waiting an hour...the reverse indexing from the SP/NameID back to the IdPSession(s) to which it's been associated for logout is a separate stored record that has an expiration based on what you set your session policies to.
Those records have an expiration that's based on how long you expect a given SP session to be around plus the sessionSlop value. So a failure to find a session in a totally separate browser would probably indicate that the logout attempt is happening after the reverse-index record had expired, meaning maybe you've got some values set too low.
The reverse indexing is just a record containing the list of all the IdPSessions involved, and its expiration slides forward any time the list gets updated:
Math.max(sessionList.getExpiration(),
spSession.getExpirationInstant() + sessionSlop)
(i.e. set expiration to the longer of "current" and "the new SPSession's expiration + slop value")
-- Scott
</pre>
</blockquote>
<br>
<pre class="moz-signature" cols="72">--
Dr. Martin Haase, Solutions Engineer
DAASI International GmbH
Europaplatz 3
D-72072 Tübingen
Germany
phone: +49 7071 407109-0
fax: +49 7071 407109-9
email: <a class="moz-txt-link-abbreviated" href="mailto:martin.haase@daasi.de">martin.haase@daasi.de</a>
web: <a class="moz-txt-link-abbreviated" href="http://www.daasi.de">www.daasi.de</a>
Sitz der Gesellschaft: Tübingen
Registergericht: Amtsgericht Stuttgart, HRB 382175
Geschäftsleitung: Peter Gietz
</pre>
</body>
</html>