Description
It should be configurable within the fediz-config.xml to disable the token validation (should be enabled by default).
If for example a SAML token lifetime is over, the fediz plugin should redirect the user to its IDP to request a new SAML token. A valid SAML token could be required at the application to invoke further web services.
Ideally the user session shall not be terminated within the fediz plugin, but should remain active, in case that the user receives a new and valid token, so that he/she can continue with their work (session) at the application.
However if the token is only needed for the login authentication and is not required later on, it should be possible to disable token validation, so that the lifetime for the "login"-token can be optimized for the login process only.
Attachments
Issue Links
- is related to
-
FEDIZ-66 Tomcat configurable token expiration validation
-
- Closed
-