## Session Duration

When a user authenticates through Shibboleth, Duke, as the Identity Provider maintains a session lifetime and inactivity timeout for the user. The session lifetime and inactivity timeout last for 120 minutes. The session lifetime duration represents the maximum period that the user's active session is allowed to remain before being automatically terminated. The Inactivity timeout refers to the active session for the user but remains idle (i.e. no actions are performed) within the application for more than 120 minutes, the session will be terminated. 

Please also note that the service/application also keeps a session for the user and it is likely that a user will be asked to log in before the times mentioned above.


## Setting Up Logout


### Set your LogoutInitiator element in your shibboleth2.xml file to look like the following:
```multi-line
<LogoutInitiator type="Chaining" Location="/Logout" relayState="cookie">
   <LogoutInitiator type="Local"/>
</LogoutInitiator>
```
   

### Initiate logout by redirecting users with the following URL for the logout script.

```multi-line
   /Shibboleth.sso/Logout?return=https://shib.oit.duke.edu/cgi-bin/logout.pl
```

This will destroy the user's session on your SP, the user's SSO session, but it will not destroy the user's session on other SPs.  

The logout.pl script can accept two optional arguments:

**logoutWithoutPrompt**  
If the value is "1", then the user is not prompted to logout. The IdP cookies are destroyed.

**returnto**

After logout, the user can be redirected to the URL you provide as a value here. The redirect location has to be a Duke address.  You would use this parameter if you want to take the user back to your application (an unauthenticated page) or display a custom logout/timeout message.

Example:  https://shib.oit.duke.edu/cgi-bin/logout.pl?logoutWithoutPrompt=1&returnto=http://www.oit.duke.edu