Does single logout trigger upon CAS session expiration? I would expect not, but maybe there's a setting to flip that? Or maybe something else is triggering single logout at two hours, and that is triggering Canvas?
On Fri, 2021-03-05 at 22:49 +0400, Misagh wrote: > > Instructure's Canvas (LMS) oddly links session timeouts to CAS' > > Ticket Expiration Policy. So, as I understand it, with the default > > Ticket Expiration Policy of 2 hours, Canvas sessions are > > automatically logging out users because Instructure chose to tie > > their Canvas-user session limits to CAS tickets. I had to increase > > the value in cas.properties to the following in order for the > > Canvas session to remain open for 4 hours: > > cas.ticket.tgt.timeToKillInSeconds=14400 > > Sure, but this has nothing to do with the Canvas session; they are > still logging people out after 2 hours, etc. There is no way they can > tell what the CAS SSO session is, and this information is not > available anywhere to an app. So by "tied it", I think you mean that > they hardcoded "2 hours" in their config because that's what they > believe CAS would do by default for the idle timeout. > > What is really happening is, they log the user out after 2 hours; > then > at session loss, Canvas redirects the user back to CAS, and CAS has a > longer SSO session, so the user is not prompted for credentials and > goes right back into canvas. > > > Interestingly, none of our other SSO-enabled applications work this > > way, i.e., tickets may expire, but users remains logged in. > > That makes sense; applications manage their own session, and while > you > may have lost SSO, the application has no need to re-auth the user > because it has a longer session expiration policy. When it does, and > there is no SSO, they get asked for credentials again. > > > After working with Support, they suggested I considered modifying > > this Per Service ( > > https://apereo.github.io/cas/6.3.x/ticketing/Configuring-Ticket-Expiration-Policy.html#per-service > > , "The expiration policy of ticket granting tickets can be > > conditionally decided on a per-application basis." > > I assume you mean Canvas support; That is not correct. It will have > no > effect on this issue. CAS will not and cannot manage the application > session. If you want the application to not log users out after X > number of hours, ask and modify the application to not log users out > after X number of hours :) > > > Is there a workaround for 5.2.x where I can just increase this > > value for Canvas, I assume in services: > > Not without custom code, lots of it, leading to hair loss and > possibly > covid. To control the application session timeout, you should modify > the application. CAS has no control over what happens inside the > application. > > The only "workaround" is what you have done; to increase the sso > session expiration time to accommodate canvas, at the expense of > affecting the relationship between the global SSO session and all > other applications. As I said, canvas will continue to log users out; > users might lose data, etc. The difference is, they won't be asked to > reauth by CAS because you increased the global sso session timeout. > > You might have read this already: > https://apereo.github.io/cas/6.3.x/installation/Logout-Single-Signout.html#sso-session-vs-application-session > -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/56c0266b93b9daf2d0e6a5e141af161dfa983302.camel%40ndsu.edu.
