Federation › Federation Security Services Guide › Configure SiteMinder as a SAML 2.0 Identity Provider › Configure Single Sign-on for SAML 2.0 › Customize the Session Duration in the Assertion

Previous Topic: Assertion Validity for Single Sign-on

Next Topic: Define Indexed Endpoints for the Assertion Consumer Service
Customize the Session Duration in the Assertion

When the SiteMinder IdP sends an assertion, by default it includes the SessionNotOnOrAfter parameter in the Authentication statement of the assertion. A third-party SP can use the value of the SessionNotOnOrAfter to set its own timeout values to determine if a user session becomes invalid and the user has to reauthenticate at the IdP.

Important! If SiteMinder is acting as an SP, it ignores the SessionNotOnOrAfter value. Instead, a SiteMinder SP sets session timeouts based on the realm timeout that corresponds to the configured SAML authentication scheme that protects the target resource.

Note: The SessionNotOnOrAfter parameter is different than the NotOnOrAfter parameter used to determine assertion validity and skew time.

To customize the SessionNotOnOrAfter parameter

  1. Log on to the Policy Server User Interface.
  2. Select the Service Provider entry you want to modify.
  3. Navigate to the Advanced tab.
  4. Select the Customize Validity duration in the Advanced SSO Configuration section of the dialog.

    The Customize Validity duration dialog displays.

  5. Select a value for the SP Session Validity Duration. The value you enter is the value of the SessionNotOnOrAfter parameter in the assertion.

    The options are:

    Use Assertion Validity

    Calculates the SessionNotOnOrAfter value based on the assertion validity duration.

    Omit

    Instructs the IdP not to include the SessionNotOnOrAfter parameter in the assertion.

    IDP Session

    Calculates the SessionNotOnOrAfter value based on the IdP session timeout. The timeout is configured in the IdP realm for the authentication URL . Using this option can synchronize the IdP and SP session timeout values.

    Custom

    Lets you specify a custom value for the SessionNotOnOrAfter parameter in the assertion. If you select this option, enter a time in the SAML_SP_CUSTOM_TIME_OUT property.

    Note: Click Help for a description of fields, controls, and their respective requirements.

  6. Click OK to save the changes.