last_access claim

[dickhardt]

last_access would be the time the user last accessed the RP in unix seconds (to align with other times)

It is a claim in the audit responses from the RP so that the OP knows then the user last accessed the app

Useful for two use cases:

1. de-provisioning to save subscription fee if user is no longer using the app
2. de-provisioning to least access. If a user is not using a service for a period of time per policy, the de-provision them.

[mcguinness]

What is the scope of last_access?

Is this the use of the session created by a previous assertion? What about offline_access tokens or other OAuth delegations or API tokens created from the session?

The resolution will be need to be RP dependent (e.g this counter isn't going to be updated on every HTTP request for a session cookie for example) and may also not be updated on use of an access_token.

Should this map more to session lifecycle management event (e.g IPSIE) vs mere generic last_access? Something like session_last_refreshed?

[dickhardt]

Was not thinking this was a security oriented signal. A granularity of days might help better align with intended use than seconds. The use case is to know if an account should be de-provisioned from lack of use -- either to save license fees and/or to adhere to a least privilege policy. While the OP will know when a login occurred -- it does not know when last_access is when off_line access has been granted.

[mcguinness]

granularity of days might help better align with intended use than seconds

This was what I was going to suggest as well. This makes the intent clearer that this is a "materialized" value over the session.

While the OP will know when a login occurred -- it does not know when last_access is when off_line access has been granted.

Can you expand on this, not following. The scenario i was asking about was

1. User SSO to RP
2. User delegates to another App to access data offline (App may not be connected to OP)
3. User session on RP and OP time out
4. User continues to use App to fetch data from RP using delegated access token

[dickhardt]

Can you expand on this, not following. The scenario i was asking about was

User SSO to RP
User delegates to another App to access data offline (App may not be connected to OP)
User session on RP and OP time out
User continues to use App to fetch data from RP using delegated access token

We are talking about the same scenario. App got off_line access and is able to continue accessing and OP is not aware that there continues to be access.

Sounds like we are aligned on last_access being how many days have passed since last access? Days since unix epoch is not really a thing I'm familiar with.