I need to implement SSO using SAML for my application which is running on NodeJS. I have doubt regarding refreshing the session expiration time for a user who has logged in through SSO.
Upon reading many documents, I came across this flag called IsPassive. My understanding about this flag is that an AuthnRequest will be sent to the IDP SSO url and the IDP will respond at the SP's Assertion Consumer Service URL with the session expiry time (if the session is alive). Is my understanding correct? Apart from that, I have a couple of questions:
- I want to develop a backend service to refresh the session timeout and session token for all the SSO users so that the SP's page is not redirected everytime the first session expires. The
AuthnRequestdoes not allow me to send the NameId for the user whose session has to be validated. How can I send theAuthnRequestwith the particular user's NameId to check his/her session's validity? - If the first Login response gave me the SessionNotOnOrAfter as time
t, will the response to theIsPassiverequest give me the response SessionNotOnOrAfter astort + x, i.e, will theIsPassiveresponse give me an extended time for the session? Also, will the SessionIndex remain the same or will it change?
I am using a serverless backend hosted on AWS Lambda and plan to send repetitive IsPassive requests to the IDP's SSO url from the Lambda.
Since I am a newbie in this, I hope I got all the names and attributes correct to describe my problem