SAML flow within MFA flow - possible c14n problem

[Cantor, Scott]

> from this I assume that (in the SAML flow in isolation, no MFA flow calling it)
> there is also nothing stopping a new result from being loaded into a new
> session in the user's browser after the old one expires? (as it does in
> Password flow).

No, that's all general code, it doesn't know anything about the specifics of what the login mechanism is.

> I can't see why this SAML flow can't load a new session/result after the first
> one expires

It can't not be there, the issue is reuse and why it doesn't believe it can do that. Or the issue is something with the session as a whole, such as it being too big for a cookie and local storage not being enabled, that kind of thing. Or even SameSite or frames, I suppose. I suspect you have cookie problems, not session issues.

> Out of interest, is there a way to set an individual flow to have no lifetime or
> timeout in its own properties? Or does this rejection of idp sessions need to
> be set globally in the idp.session.enabled?

There is no way for them to be unset, but a reuseCondition of false will obviate any reuse of a result regardless of the other settings, as of course in practice would a lifetime that's very short.

-- Scott