Session state in EB 4.0.0

This page describes all session state kept for users.

Cookies

PHPSESSID

Session identifier. This is the temporary token handed to a user and kept in a HTTP cookie (sent with every request) that grants the user access to his/her session.

Note that this name depends on the session.name setting and it's scope depends on session.cookie-domain.

It's lifetime depends on session configuration but by default this is a 'session cookie' meaning that the browser will delete it when it is closed.

lang

Language to show the user interface in (defaults to en).

It's scope and lifetime depends on EngineBlock configuration, by default this is:

; Language Cookie settings
cookie.lang.domain = ".surfconext.nl"
; Cookie expiry time, specify the time in seconds, set empty to let the cookie get expired after the session
cookie.lang.expiry = 5184000 ; 60 days in seconds

selectedidp

Entity ID of the Identity Provider that was previously selected and will be shown as 'suggested' in the Identity Provider discover screen.

It's scope is the current domain, it's lifetime is 3 months.

Session data

Operational

SAMLRequest

SAMLResponse

Consent

Processing

Profile Group OAuth data

CollabPersonId

Transient NameID

Auditing

• Last error feedback data
• Logging
• Current ServiceProvider / Identity Provider
• Response from Idp for Idp Debugging

Session timeout

EngineBlock uses the native PHP Session controls that means the settings described at "Session Configuration" on php.net are relevant.

By default this will mean that a session will live 24 minutes past it's last accessed date.