SessionNotFound

[Cantor, Scott]

> you hit the nail on the top. There *was* another assertion issued to the
> same SP, same user, in between. So the SP issued this AuthNRequest
> although I have set timeout and lifetime to both 28800s as well there.
> From what I can see in my own logs, the application did not lose its
> session. But the SP, and how could it lose its session?

That's more of an application question probably, I doubt it has anything to do with the SP.

> And given this is what happens in the real world, is there a way to handle this
> gracefully at the IdP?

Not without significant redesign, and absent funding targeted at that, it isn't even a conversation.

-- Scott