Session Lifetime of constituent flows in MFA

[Cantor, Scott]

On 3/11/22, 9:30 AM, "users on behalf of John Watt" <users-bounces at shibboleth.net on behalf of John.Watt at glasgow.ac.uk> wrote:

>    The only way I could get them to persist was to set a lifetime for the MFA flow itself of at least as long as the
> SAML lifetime.

I thought I had said that. You can make them longer, not shorter, by definition.

>  This is probably obvious, but is this because the MFAContext needs to be live in order to extract the results of
> the individual flows it calls? (so if the MFA lifetime was less than the SAML one, the SAML result would
> disappear along with it?)

Yes. To the IdP, the only result is MFA. MFA is a result that contains other results and manages them internally based on the rules you build. It's an authentication manager within an authentication manager. The IdP's manager is designed for simple or multiple non-overlapping use cases. The MFA manager is for everything else.

-- Scott