Premature Authn Result Expiration w/MFA

[Cantor, Scott]

> 	I can spin something up here and try and verify the testbed is
> honoring a timeout longer than an hour.
> 
> Thanks -- really appreciate that.

With default lifetime/timeout of 2H and a session timeout of 3H, I waited about 1:15 and I'm still seeing reuse of the result, so it's definitely not hardwired to an hour. All I did was change the properties, fix the MFA defaults back to IPAddress/Password, and switch from Password to MFA.

> I think this is all you need from idp.properties. Let me know if you need
> further information:

I think we'd need pretty low level logging to catch what it's actually doing, but perhaps we could patch to elevate the log level of the code that's extracting the MFA result.

I would tend to think this is more likely a session storage issue, but if the objects are still there, the relevant code is in net.shibboleth.idp.session.impl.ExtractActiveAuthenticationResults. It's logging the status of each result it looks at on DEBUG. There's also no logging in the isResultActive() method it's calling and that could be added to determine what criteria is failing.

I assume there's no chance the client's losing its cookie.

-- Scott