Premature Authn Result Expiration w/MFA

[Cantor, Scott]

> Presumably the first corresponds to what we're seeing as premature
> reauthentication. So it looks like the session is returning an empty collection
> for IdPSession#getAuthenticationResults(), which is what you'd expect if the
> results had expired prematurely and were purged from persistent storage.

Right. I'll review my understanding of the code, but don't know offhand why the MFA result would be behaving any differently than the rest. It's a sliding timeout-based record expiration, i.e. the code updates the expiration of the result record to reflect the last time it was used (and then the lifetime check is performed on top of that).

-- Scott