<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="text-align:left; direction:ltr;">
<div>Michael,</div>
<div><br>
</div>
<div>Your SP session should be managed from within the SP.</div>
<div><br>
</div>
<div>What would happen to your SP-X session when user accessed SP-AAL3?</div>
<div><br>
</div>
<div>Ray</div>
<div><br>
</div>
<div>On Tue, 2020-01-28 at 17:02 -0500, Michael Gettes wrote:</div>
<blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex">
<pre>I would like to be able to have a default config for Idle Timeout (and maybe more, but this is a start for now) based on a combination of the user (what LDAP group(s) they may be a member of) and the application/SP they are accessing.</pre>
<pre><br></pre>
<pre>Scenario:</pre>
<pre><br></pre>
<pre>I access an SP-X via my IdP-Home and I receive a default session of 10H and an idle timeout of 10H.</pre>
<pre>I then go to access SP-AAL3 and because I am a user in ldap group AAL3 my IdP-Home sees</pre>
<pre>I am accessing SP-AAL3 and sets my idle timeout to 30M. This appears to not be possible now???</pre>
<pre><br></pre>
<pre>I realize I could have SP-AAL3 be bound to another IdP-AAL3 like my IdP-Home but with different</pre>
<pre>idle timeout config of 30M but this would involve an additional SSO sign-on - which would annoy my users. </pre>
<pre>But, if I configured IdP-AAL3 to be just like IdP-Home (same keys and crypto for cookies) and SP-AAL3 was</pre>
<pre>configured to only use IdP-AAL3 - would I not still get a SSO experience for my users without the</pre>
<pre>additional sign-on event? Would this get me an idle timeout to 30M going forward for all interactions with</pre>
<pre>SP-AAL3 and 10H for all SPs associated with IdP-Home? Has anyone done this?</pre>
<pre><br></pre>
<pre>I am trying to keep the scenario as simple as possible. If this is not possible right now, what would</pre>
<pre>It take to make this possible?</pre>
<pre><br></pre>
<pre>Thoughts and pontifications appreciated.</pre>
<pre><br></pre>
<pre>/mrg</pre>
<pre><br></pre>
</blockquote>
<div><span>
<pre>-- <br></pre>
<div>Ray Bon</div>
<div>Programmer Analyst</div>
<div>Development Services, University Systems</div>
<div>2507218831 | CLE 019 | <a href="mailto:rbon@uvic.ca">rbon@uvic.ca</a></div>
<div><br>
</div>
<div>I respectfully acknowledge that my place of work is located within the ancestral, traditional and unceded territory of the Songhees, Esquimalt and WSÁNEĆ Nations.</div>
</span></div>
</body>
</html>