Session timeout issue SP 3.0.2

[Peter Schober]

* Ron Harris <neo204011 at gmail.com> [2018-10-01 10:06]:
> Scenario 1:
> User tries to access the protected page, he is directed to AFDS page, upon
> successful login he gains access to protected page.
> After few minutes User closes the brower. Opens the brower back and enters
> the protected page url. he is redirected to ADFS page, but without having
> to do login, he is directed back to protected page. It seems somehow the
> username/password was injected to ADFS page.

>From the above (SP redirects to IDP) it seems clear the SP session is
gone but the IDP session still seems to be active, hence you
experience SSO.

> Scenario 2:
> User tries to access the protected page after 24 hours. Now it is expected
> that ADFS page be shown to user for login. But now also, the ADFS page is
> injected with credentials and taken to protected page.

If the SP sends the browser's subject to the IDP then it doesn't have
an active session. You can see this in detail using the "SAML tracer"
extension for the Firefox and Chromium/Chrome browsers.
What happens at the IDP is mostly the IDP's business.

> Please let me know how to make the user enter his credentials again,
> when times is over for both lifetime and timeout?

Look at your IDP and its sessions and timeouts.

The only thing the SP can do is force re-authentcation every time it
sends an authn request to the IDP, disabling SSO at the IDP completely
for logins to this SP. This is likely not what you want.

-peter