3 ms·
On the SP side, I frequently see extremely short session lengths as the simple (but annoying) alternative to checking if a session is revoked. GitHub requires
by cj 5y ago
On the SP side, I frequently see extremely short session lengths as the simple (but annoying) alternative to checking if a session is revoked.
GitHub requires SAML re-auth every 24 hours. AWS defaults to 1 hour but customizable. Do many SP’s even support SLO in a standardized manner? I believe there is a spec/standard for it, but I could be mistaken.
- krinchan 5y agoThere is no good spec. There are several conventions that are almost always IdP specific. That said, you hit on the main point: The best way to handle Single Log Out is to not handle single log out. If I log out of a federated AWS session, I am not logged out of Okta. If I log out of Okta, I am not logged out AWS. Unfortunately, someone saw SLO was a feature and ordered us to enable it and provide support to the SPs to implement it against my recommendations to do otherwise and here we are.