Premature Authn Result Expiration w/MFA

[Cantor, Scott]

> We have deployed the new MFA framework in a recent 3.3.0 snapshot to
> production last week and since we've noticed what appears to be premature
> authentication result expiration. I have reviewed all the configuration that I
> can think to check, and everything appears configured as needed to provide
> the policy we want; namely that authentication results do _not_ time out
> prior to the IdP session that lasts 24h. Instead it looks like they're timing out
> on the order of the default 60m.

The MFA result timeout should be handled the same as any other flow result's timeout. The individual results that make up the MFA result do not have independent timeouts themselves, that's not practical to implement in the design that I used. They do have lifetimes, but not inactivity timeouts.

> I don't see any new MFA-specific knobs related to timeouts, nor do I see
> how this could arise naturally from the composition of authentication flows
> via the MFA orchestration. Any suggestions or thoughts on what's
> happening?

No, none. I have tested with very low values to make sure the code was behaving the way I expected but it's not easy to simulate more realistic numbers. I can spin something up here and try and verify the testbed is honoring a timeout longer than an hour.

What are the settings you're using?

-- Scott