So we are relying on the application to set the limit for each assertion
sent? When you say "relying site" which one do you mean? Sender or
receiver? Is there a default timeout that can be configured?
-----Original Message-----
From: Scott Cantor [mailto:]
Sent: Wednesday, November 13, 2002 7:50 AM
To: ; 'John Herendeen'; 'Adam Theo'; 'Mark
Wilcox'
Cc:
Subject: RE: [saml-dev] Introduction & Question about the "heaviness" of
S AML
>Are the minutes configurable?
It's more or less unspecified. "Long enough to get it from site A to B,
short enough to limit the danger." A relying site has its own policy on
how long a SSO assertion should be valid.
-- Scott
----------------------------------------------------------------
To subscribe or unsubscribe from this elist use the subscription
manager: <http://lists.oasis-open.org/ob/adm.pl>
