Saml2: How does detecting if an account has been disabled work?
I have Kentor set up and managing logging into my application via the OneLogin IdP.
I am confused at how the application is supposed to know when a user account has been disabled (or had permissions changed) at the IdP. My understanding is that the claims issued by the IdP are with some regularity supposed to "expire", at which point the authentication library needs to reach out to the identity provider to get a refresh of the most recent version. It can do this without a password (since it has the old claims it can prove that it had access at one point).
What I'm unclear over is
- Is that correct?
- What part of this does Kentor AuthServices handle? What part do I need to do myself?
- How do I set how often claims expire?
togakangaroo
>All comments
The SAML assertion from OneLogin may contain a SessionNotOnOrAfter attribute that AuthServices respects for the session length. After that expires, a new authentication is done against OneLogin. If there is an existing session on the Idp, that authentication might be completely invisible to the user.
There is no way in SAML to revalidate an existing session except doing another authentication.
AndersAbel
on 8 Aug 2017
Related issues
JustinPealing
路
4Comments
nzhuravel
路
5Comments
bitbybitllc
路
5Comments
themartinhawkins
路
5Comments
jaydinslage
路
8Comments
Most helpful comment
The SAML assertion from OneLogin may contain a
SessionNotOnOrAfterattribute that AuthServices respects for the session length. After that expires, a new authentication is done against OneLogin. If there is an existing session on the Idp, that authentication might be completely invisible to the user.There is no way in SAML to revalidate an existing session except doing another authentication.