Shibboleth Developers

[Tom Scavo <>]

On 12/10/05, Scott Cantor 
<>
 wrote:
>
> If you overload the TTL of the cert with the TTL of the identifier in order
> to combine the two concepts, then I suppose the simplest way to implement
> that is to set the assertion's expiration to be the same and then copy that
> over to the certificate.

Are you suggesting to use the Conditions element for this purpose?  I
thought about that, but this is not done today and would introduce new
semantics into the assertion.  Today, as far as I can tell, the life
of the assertion (given by the Conditions) and the life of the
NameIdentifier are totally separate.  Specifically, the life of an
authentication assertion is fixed while the life of an attribute
assertion is dictated by the longest-lived attribute.

On second thought, using Conditions to convey the NameIdentifier TTL
contradicts the short lifetime (5 min) principle associated with
bearer assertions.  Is there any alternative?

Thanks,
Tom