Different inactivityTimeout in a MFA environment

[Francesco Malvezzi]

On 21/01/25 15:25, Cantor, Scott wrote:
>> However, if I'm not mistaken, it looks the inactivityTimeout
>> from the  outer authn/MFA overrules my configuration.
> 
> That's correct, it wraps the other results so it can't be shorter than those.
> 
>> If I'm right, how can achieve a setup with different
>> inactivityTimeout based on the used subflow in a MFA
>> environment?
> 
> No direct or simple way. It's possible to implement a custom reuseCondition that can attach to the MFA flow and dig into what the embedded results were and enforce a custom timeout programmatically.

thank you so much for the clarification and the hint.

By the way, some clever people suggested me that, just for this very 
limited purpose (limiting the number of times the TOTP verification view 
shows up during a session), it is possibile to just set a custom cookie 
in the totp.vm view and have its presence verified in the 
nextFlowStrategy bean leading to TOTP,

Francesco