Shibboleth SP 3 and SubjectConfirmation NotOnOrAfter seems to be ignored

[Cantor, Scott]

> Under what circumstances does Shibboleth SP (apparently) not observe the SubjectConfirmation’s NotOnOrAfter?

None. It applies to intial processing of the assertion, nothing more. I would suspect perhaps you're dealing with an IdP setting SessionNotOnOrAfter which has a totally different meaning and bounds the SP session.
 
> What mechanism determines the number of idle minutes?

The timeout.
 
-- Scott