Skip to main content
Topics#SecurityPregunta de Doug Leeper
Doug Leeper preguntó en #Security
27 feb 2020, 20:50

Session Refresh

We have an Ng app on AWS that utilizes Cognito.  Cognito utilizes SFDC as its IDP to authenticate users.  Currently using SAML between Cognito and SFDC.

The users are authenticating against a Community which has its Session duration set to 30min before logging out the session.

Since all User activity is via Ng to other internal REST services (effectively no SFDC activity), the SFDC session is timing out.

How does one "tickle" the Session timer to restart the session if the application is not hosted on SFDC?

Is there an OOTB endpoint?

Do I need to create an endpoint, aka dummy page that is accessed from the users browser?

Do I need to utilize OAuth instead of SAML?

Has anyone have this architecture in place?  If so, how did you solve this problem.

Thanks in advance,

Doug

 
1 respuesta
  1. Doug Leeper
    4 mar 2020, 20:15

    To give a little more context, here is diagram that explains the situation visually.

    • We are using a SFDC community for our IDP.  
    • Our Ng app is a Service Provider.  
    • The Ng App is using Cognito.  
    • Cognito is configured with SAML to SFDC Community for its IDP via a Connected App.
    • Ng app never communicates directly with SFDC after login.
    • All data calls are via REST API calls via Mulesoft.
    • These REST API calls have a user context.
    • THe user context is never utilized to call back into SFDC but is used to filter data back.
    • Our SFDC default session timeout is 12 hours 
    • Our community is setup with 30min Session timeout which overrides the default session timeout
    • In this diagram, you can see there is nothing that will "tickle" / reset the SFDC session.
    • What is occurring is that the SFDC Session is expiring and initiates a Single Logout to our connected app...even though the user has been active on the app itself.

    To give a little more context, here is diagram that explains the situation visually.We are using a SFDC community for our IDP. Our Ng app is a Service Provider. The Ng App is using Cognito.
Escribir una respuesta...
0/9000