OIDCSessionMaxDuration cannot be set to 0 in 2.4.16.1

[amitmun]

According to the configuration file, setting to 0 is supported:

# Maximum duration of the application session
# When not defined the default is 8 hours (3600 * 8 seconds).
# When set to 0, the session duration will be set equal to the expiry time of the ID token.
# NB: this can be overridden on a per-OP basis in the .conf file using the key: session_max_duration
#OIDCSessionMaxDuration <seconds>

However I get the following error message:

Starting The Apache HTTP Server...
AH00526: Syntax error on line 34 of /etc/httpd/conf.d/httpd-iam.conf:
Invalid value for directive 'OIDCSessionMaxDuration': integer value 0 is smaller than the minimum allowed value 15

[zandbelt]

that option was removed in 2.4.16.x indeed but the documentation was not adapted; however we'll consider re-introducing it

[amitmun]

I've been using it for years. Any reason for changing the behavior?

[zandbelt]

arguably the id_token should be regarded and treated as an authentication event: the exp claim in there indicates until when the id_token can be consumed; hence it is a token timeout, not a session in itself and as such has no semantic relationship with the session that mod_auth_openidc creates; however, it is only a small change to support it and backwards compatibility wins here, see 7b796ca ; it will be part of the upcoming 2.4.16.2 again