Grouper Users - Open Discussion List

["Gettes, Michael" <>]

I’m a wee bit confused here.  What we are talking about is what the initial 
or recommended setting would be.  A grouper admin could always change the 
settings by directly updating the relevant config (which I believe we should 
be clearly documenting if we haven’t) or overlaying the config if using 
containers (which of course everyone should be moving towards, IMHO)?  It’s 
not like we are saying EVERYONE MUST adhere to this config.  People can still 
do as they wish.  Changing this is really about getting those who choose not 
to modify anything to maybe complain less to the community/developers?

Of course, what would be really nice is if grouper-ui doing all its ajax-y 
stuff could better detect a re-auth “fail” and better handle it but I do 
appreciate how that can be hard to do.

/mrg

> On Jun 9, 2019, at 5:36 PM, Hyzer, Chris <> wrote:
> 
> Ive been embracing having the shib SP in front of entire UI applications, 
> then only an authenticated (and authorized?) user can hack at the 
> application.  Could be just apache and a proxy_ajp, or an apache reverse 
> proxy in front of an application (e.g. non java).  Check a course grained 
> entitlement to make sure the authenticated user is active at the 
> institution.
>  
> Anyways, I guess you disagree with the default of 60 minutes, so we need to 
> vote or something…  anyone else feel adamant about 30 min vs 60 min?
>  
> Thanks
> Chris
>  
> From: Bill Thompson <> 
> Sent: Saturday, June 08, 2019 10:53 AM
> To: Hyzer, Chris <>
> Cc:  Mailing List <>
> Subject: Re: [grouper-users] Grouper UI default timeout in ITAP container
>  
> For applications that have their our session management, I tend to want to 
> get the Shib SP out of the way as soon as possible to cut down on confusion 
> and keep things simple. In this scenario the Shib SP is simply there to 
> handle the SAML authN Response and hand-off the authenticated subject/netid 
> to tomcat/grouper.  Application session management is then totally in the 
> hands of tomcat/grouper.
>  
> In this setup, WebSSO session behavior is whatever the institution decides 
> at the Shib IdP/CAS configuration level. Grouper application session 
> management is completely controlled by however tomcat/grouper is 
> configured. A reasonable default would be 30 minutes idle (aka inactivity) 
> time, but folks could set that to whatever they want based on local policy.
>  
> Best,
> Bill
>  
> On Fri, Jun 7, 2019 at 5:47 PM Hyzer, Chris <> wrote:
> There are three timeouts at play in the Grouper UI with the ITAP container:
>  
>       • The tomcat java session inactivity timeout (current default config 
> is 30 min)
>       • The Shib SP timeout inactivity timeout (current default config is 8 
> hours)
>               • The Shib SP session session lifetime (current default 
> config is 8 hours)
>       • The SSO IdP timeout (configured at each institution, my gut feeling 
> is this is >= 1 hour generally)
>  
> Ive had complaints about 30 min sessions being too short.
>  
> In my mind, the current configuration does not make sense.  If the tomcat 
> session dies in 30 minutes, the shib SP session will start another one 
> (since active for 8 hours).  But whatever the person was working on will be 
> interrupted and a potential CSRF error will occur.  I think the tomcat 
> session should equal the shib SP session.  If the shib/tomcat is 30 
> minutes, and the typical SSO/Idp session is >= 60 minutes, then again the 
> user is disrupted of their session, they do not need to login, but might 
> experience an error.
>  
> We discussed this on slack, and I recommend we change the *default* shibSP 
> / tomcat timeout to 60 minutes.  The 8 hour SP session lifetime should not 
> change. In addition we will document how to overlay adjustments to the 
> config.  
>  
> Also, btw, Matt Black suggested in jira that we change the UI to show a 
> message about session timeout (so you aren’t surprised the next time you 
> click) which I agree with and we can see if we can get something simple to 
> work before too long.
>  
> Let us know any thoughts about this change.  😊
>  
> Thanks!