SAML TOKEN LIFE TIME best practices

Question

what should be the saml token life time for SSO app. are there any best practices for this ? do we need to maintain application session equal to saml token lifetime ?

Answer 1

The SAML "token" lifetime is typically very short.

SAML messages including the response and assertion typically have an IssueInstant which states when the message was created.

In addition the Assertion typically has Conditions that include an NotBefore and NotOnOrAfter datetime and an AudienceRestriction. This basically states how long the Audience should trust that Assertion. The trust for the assertion has nothing to do with how long you keep the session active. Similar to any authentication method the user was authenticated at that specific Instant. The user account may have been disabled seconds later.

The Service Provider (Application) needs to decide how long it will keep that session active before prompting for the use to log in again. It is a risk based decision based on the security needs of the Application in question.

<Conditions NotBefore="2022-08-20T02:45:48.365Z"
            NotOnOrAfter="2022-08-20T03:50:48.365Z">
  <AudienceRestriction>
    <Audience>https://netsaml2-testapp.local</Audience>
  </AudienceRestriction>
</Conditions>

The example above give you a little more than an hour to trust the assertion. That may be a valid session length but I have also seen 5 minutes which might not be a appropriate session length. The condition is more aboout dealing with Clock Skew between the SAML parties than anything else.

The Assertion says that the user Authenticated successfully not how long you should keep the session active