SSO session lifetime in IdP

[Cantor, Scott]

> If I instruct SP to use 15 min session, it won't make any difference.
> When SP session times out there is a round trip to IdP and user is still
> signed in due to longer IdP session. Correct?

Yes.

The IdP does not support per-SP determination of SSO duration. If you want control, you have to use ForceAuthn and work with that set of issues to get the outcome you want.

-- Scott