reuse condition vs. maximumTimeSinceAuthn

[Cantor, Scott]

> But that would be plan b, since maximumTimeSinceAuthn sounds exactly like what I
> need. 

It's not, that's a SAML proxy setting equivalent to the same setting in the SP (as the IdP is operating as one when it proxies). It controls validation based on the AuthnInstant in the assertion.

There is, in point of fact, no such thing in the IdP as a "session lifetime", only sliding windows based on inactivity. The relevant setting is the authentication flow result lifetime (or timeout), which the reuseCondition overrides/supplements, and that's not at the session level, it's at the individual flow result level.

-- Scott