<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
I am trying to get my head around how SP and IdP timeouts generally
work and are generally configured.<br>
<br>
1. Our IdP is v3.3.3 and looking through the online documentation I
see reference made to several files that contain lifetime and
timeout property. Using grep you can see the file and property:<br>
<br>
<table width="870" height="382" cellspacing="2" cellpadding="2"
border="1">
<tbody>
<tr>
<td valign="top">conf/authn/ldap-authn-config.xml</td>
<td valign="top">p:connectTimeout="%{idp.authn.LDAP.connectTimeout:3000}"</td>
</tr>
<tr>
<td valign="top"><br>
</td>
<td valign="top">p:blockWaitTime="%{idp.pool.LDAP.blockWaitTime:3000}"</td>
</tr>
<tr>
<td valign="top"><br>
</td>
<td valign="top">p:idleTime="%{idp.pool.LDAP.idleTime:600}"
/></td>
</tr>
<tr>
<td valign="top">conf/authn/general-authn.xml</td>
<td valign="top">p:lifetime="PT60S"
p:inactivityTimeout="PT60S"></td>
</tr>
<tr>
<td valign="top">conf/idp.properties</td>
<td valign="top"><b>#idp.session.timeout = PT60M</b></td>
</tr>
<tr>
<td valign="top"><br>
</td>
<td valign="top"><b>#idp.session.defaultSPlifetime = PT2H</b></td>
</tr>
<tr>
<td valign="top"><br>
</td>
<td valign="top"><b>#idp.authn.defaultLifetime = PT60M</b></td>
</tr>
<tr>
<td valign="top"><br>
</td>
<td valign="top"><b>#idp.authn.defaultTimeout = PT30M</b></td>
</tr>
<tr>
<td valign="top"><br>
</td>
<td valign="top"><b>#idp.consent.storageRecordLifetime = P1Y</b></td>
</tr>
<tr>
<td valign="top"><br>
</td>
<td valign="top"><b>#idp.policy.messageLifetime = PT3M</b></td>
</tr>
<tr>
<td valign="top">conf/ldap.properties</td>
<td valign="top"><b>#idp.authn.LDAP.connectTimeout = 3000</b></td>
</tr>
<tr>
<td valign="top"><br>
</td>
<td valign="top"><b>#idp.pool.LDAP.idleTime = 600</b></td>
</tr>
<tr>
<td valign="top"><br>
</td>
<td valign="top"><b>#idp.pool.LDAP.blockWaitTime = 3000</b></td>
</tr>
<tr>
<td valign="top">conf/services.properties</td>
<td valign="top"><b>#idp.httpclient.connectionTimeout = -1</b></td>
</tr>
</tbody>
</table>
<br>
Not that properties that I've put in bold (ones that start with #)
are currently commented out for our IdP. Is there any user session
lifetime/timeout in play at all for our environment? Or am I missing
something?<br>
<br>
<br>
2. Looking at the SP3 online documentation I see:<br>
<br>
lifetime (seconds) [default = 28800 (8 hours)]<br>
<tt> Maximum duration in seconds that a session maintained by the
SP will be valid. The actual time may be less than this value (if
an IdP indicates it should be shorter) but will never be longer.
Note that this will not influence sessions maintained by an
application.</tt><tt><br>
</tt><br>
timeout (seconds) [default = 3600 (1 hour)]<br>
<tt> Maximum inactivity allowed between requests in a session
maintained by the SP. This inactivity applies only to requests to
this SP and is not aware of activity between the browser and other
web sites (or even other applications on this system). A value of
0 disables timeout checking, but the expiration of the session may
be otherwise bounded by the cacheAllowance setting on the
SessionCache.</tt><tt><br>
</tt><br>
cookieLifetime (seconds)<br>
<tt> If set, cookies used for session management will be created
with the designated lifetime. When omitted, which is the default,
such cookies are in-memory only and do not persist across browser
restarts (assuming various session restore features aren't in
use). Note that this will not affect "transitory" cookies used for
maintaining state across redirects.</tt><tt><br>
</tt><br>
3. We have many hosted (off-prem) SPs, some that are InCommon
members and others that are not. If their configuration is not
using a Shibboleth SP mechanism to protect the SP, I am sure their
are lifetime and timeout setting somewhere as well, correct?<br>
<br>
4. Do any properties exist in the SP's web server itself that
controls inactivity of the user session? <br>
<br>
<br>
<pre class="moz-signature" cols="72">--
D o n a l d L o h r
I n f o r m a t i o n S y s t e m s
J a m e s M a d i s o n U n i v e r s i t y
5 4 0 . 5 6 8 . 3 7 3 0
DOS: Bad command or file name
bash: command not found
</pre>
</body>
</html>