Premature Authn Result Expiration w/MFA

[Cantor, Scott]

> Right. I'll review my understanding of the code, but don't know offhand why
> the MFA result would be behaving any differently than the rest. It's a sliding
> timeout-based record expiration, i.e. the code updates the expiration of the
> result record to reflect the last time it was used (and then the lifetime check
> is performed on top of that).

Not seeing anything that would suggest MFA would introduce any changes here.

The DEBUG category relevant to this is net.shibboleth.idp.session.impl.UpdateSessionWithAuthenticationResult. It should be logging every time the result is reused for SSO and bumps the timer.

The underlying method that updates the expiration should be warning if it saw anything unusual.

                if (!sessionManager.getStorageService().updateExpiration(getId(), result.getAuthenticationFlowId(),
                        result.getLastActivityInstant() + flow.getInactivityTimeout()
                            + AuthenticationFlowDescriptor.STORAGE_EXPIRATION_OFFSET)) {
                    log.warn("Skipping update, AuthenticationResult for flow {} in session {} not found in storage",
                            flowId, getId());
                }

If that's not failing I don't have another explanation other than the storage service itself misbehaving. If the master session record were missing, that would also break it, but I think you said that was confirmed not to be the case based on the logs. That record expiration gets updated earlier in a different step.

-- Scott