Shibboleth Developers

["Scott Cantor" <>]

> Actually, we've always had two time values -- idle time, and 
> session time. Most apps use idle time to determine when to 
> require re-authentication, not the elapsed session time. I'm 
> not actaully sure what our Apache module for Bluestem stuffs 
> them into (as far as variable names), as I've 
> always used our subroutine API to get the information.

I enforce both, but the context here is for communicating the time left
on somebody's login "token" to the HS if it wants to bound the lifetime
of the handle/attributes in some algorithmic way. Idle time/timeouts
don't really apply to that situation.

-- Scott

------------------------------------------------------mace-shib-design-+
For list utilities, archives, subscribe, unsubscribe, etc. please visit the
ListProc web interface at 

    http://archives.internet2.edu/

------------------------------------------------------mace-shib-design--