7.15 Configuring the Liberty or SAML 2.0 Session Timeout

When you are active on a session on the service provider and a timeout occurs, the service provider initiates a logout.You can configure this timeout by using the web.xml parameter in the Access Gateway ESP, then ESP initiates a logout message to the Access Manager Service Provider over the SOAP back channel when the timeout is reached. After the Service Provider receives this message, it creates a SAML 2.0 logout request to the remote Identity Provider over SOAP.

To send session timeout message:

Open the web.xml file located at:

/opt/novell/nam/idp/webapps/nidp/WEB-INF/
Add the following lines to the file:
```
        <context-param>
                <param-name>notifysessionTimetoIDP</param-name>
                <param-value>true</param-value>
        </context-param>
```
ESP will send a ESP session timeout message then on timeout, the service provider will send a samlp:LogoutRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol request to the remote Identity provider.
Save the file, then copy it to each Identity Server in the cluster.
Restart Tomcat on each Identity Server in the cluster using the following command:

/etc/init.d/novell-idp restart

7.15.1 Session Termination

If you set the session synchronization between the Service Provider and remote Identity Provider, then the remote Identity Provider never sends the logout request to the active Service Provider.