Bill, Mike, The combination of timeToKillInSeconds and maxTimeToLiveInSeconds provides a sliding window for TGT lifetime. Every request for a ST (or PT) will extend the life of the TGT by timeToKillInSeconds up to maxTimeToLiveInSeconds. So, since Canvas is not using a proxy request, and does not have a hidden iFrame, it must be probing Cas near its session end (as Misagh mentioned). [Could javascript be used to probe Cas?] One could look at the cas logs to see the request(s). I set my local with very short TGT life time to test repeated login and ticket expiry behaviour (this would not be practical in production):
cas.ticket.tgt.maxTimeToLiveInSeconds=300 cas.ticket.tgt.timeToKillInSeconds=120 Ray On Fri, 2021-03-05 at 12:41 -0800, Mike Osterman wrote: Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information. Hi Bill, I was dealing with people getting logged out Canvas frequently, and ended up changing a couple config properties. I had our CSM team set the Canvas-side timeout really high, but it didn't work. There's something unusual about the way the Canvas application interacts with CAS protocol. I had checked for callbacks from the Instructure servers, but it really does seem to be managing the session after the initial SSO flow. By the way, do you use a Discovery URL? That's when our session behavior seemed to change, but it may just be correlation rather than causation. I eventually set two properties and got it to behave as expected, but never figured out which one did the trick: cas.ticket.tgt.timeout.maxTimeToLiveInSeconds: https://apereo.github.io/cas/5.2.x/installation/Configuration-Properties.html#timeout AND server.session.timeout: https://apereo.github.io/cas/5.2.x/installation/Configuration-Properties.html#web-application-session It sounds like you've found that it was the first one, so I wanted to corroborate that for you. I just ended up setting these properties server-wide in cas.properties, which isn't ideal, because you have a single service dictating timeout behavior for all services using CAS. I've also considered switching over to using CAS's SAML2 IdP functionality for Canvas, but need to wait for an appropriate time to make that change. Finally, so as not to hijack the thread and keep the proxy ticket service configuration comment from Ray alive, I think this is how the service would be configured for it: https://apereo.github.io/cas/5.2.x/installation/Configuring-Service-Proxy-Policy.html I did look for server-side traffic from Canvas as Ray suggested, but didn't find any as mentioned above. I just checked for an iFrame, which would be client-side traffic, but didn't see anything in the Network tab of developer tools. -Mike On Fri, Mar 5, 2021 at 12:01 PM Bill Scully <[email protected]<mailto:[email protected]>> wrote: Hi Ray, Another possibility, Canvas is using is a proxy ticket. Does your service definition allow proxying? I would say, no. It's pretty straightforward: { "@class" : "org.apereo.cas.services.RegexRegisteredService", "serviceId" : "^https://[omitted]/.*";, "name" : "Canvas", "id" : [omitted], "evaluationOrder" : [omitted] } I looked at what I think covers proxy ticketing (https://apereo.github.io/cas/5.2.x/installation/Configuring-Ticket-Expiration-Policy.html#proxy-ticket-policies), but didn't see how to configure. Any example I could try? Thanks. Bill -- Ray Bon Programmer Analyst Development Services, University Systems 2507218831 | CLE 019 | [email protected]<mailto:[email protected]> I respectfully acknowledge that my place of work is located within the ancestral, traditional and unceded territory of the Songhees, Esquimalt and WSÁNEĆ Nations. -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/5dcc06393380194469adb10dce36b81453fccae6.camel%40uvic.ca.
