RE: [saml-dev] Introduction & Question about the "heaviness" of S AML

[Neil Gehani <ngehani@us.checkpoint.com>]

So we are relying on the application to set the limit for each assertion
sent? When you say "relying site" which one do you mean? Sender or
receiver? Is there a default timeout that can be configured?

-----Original Message-----
From: Scott Cantor [mailto:cantor.2@osu.edu] 
Sent: Wednesday, November 13, 2002 7:50 AM
To: ngehani@us.checkpoint.com; 'John Herendeen'; 'Adam Theo'; 'Mark
Wilcox'
Cc: saml-dev@lists.oasis-open.org
Subject: RE: [saml-dev] Introduction & Question about the "heaviness" of
S AML


>Are the minutes configurable?

It's more or less unspecified. "Long enough to get it from site A to B,
short enough to limit the danger." A relying site has its own policy on
how long a SSO assertion should be valid.

-- Scott


----------------------------------------------------------------
To subscribe or unsubscribe from this elist use the subscription
manager: <http://lists.oasis-open.org/ob/adm.pl>