Session Lifetime of constituent flows in MFA

[Cantor, Scott]

>    Is this scenario (where the authn/X509 has its own longer lifetime override) honoured when these flows are
> invoked from an MFA flow?

If MFA contains Password + X.509, then MFA also (usually) contains the supportedPrincipals of both. That result will satisfy any subsequent request sartisfied by one or the other, and the lifetime of the factors alone doesn't enter into it, if MFA results are allowed to be reused. The Principals carried by the master result don't have lifetimes themselves.

If MFA results are not allowed to be reused, then the MFA rules that run Password and X.509 will by default reuse existing results if they can, to optimize the UI, within their individual lifetimes, and those can vary.

As a result, longer lifetimes can never work for obvious reasons (the MFA result container expires before the X.509 child could ever be reused) but shorter lifetimes can work if the MFA result resuse is blocked to allow the individual results to be interrogated every time a request comes in.

It's another use case that requires setting a false or more limited reuseCondition on the MFA flow, as with policies that will vary by user and service together, to ensure those rules get a chance to run.

-- Scott