Different inactivityTimeout in a MFA environment

[Francesco Malvezzi]

[...]
> 
> No direct or simple way. It's possible to implement a custom reuseCondition that can attach to the MFA flow and dig into what the embedded results were and enforce a custom timeout programmatically.

upon exploring this path, I realized I don't know where the information 
about the subflows is.

Starting my search from: 
https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199511904/Authentication#Authentication--and-Session-Related-Context-Tree, 
I peered into the:
AuthenticationContext 
AuthenticationContext{initiationInstant=2025-01-29T08:06:33.951247347Z, 
isPassive=false, forceAuthn=false, requiredName=null, hintedName=*, 
maxAge=null, potentialFlows=[authn/MFA], activeResults=[authn/MFA], 
attemptedFlow=null, signaledFlowId=null, authenticationStateMap={}, 
resultCacheable=true, authenticationResult=null, completionInstant=null}
and the:
IdPSession 
StorageBackedIdPSession{sessionId=625b2ce57dd4a3cff7e2b71f0ec0f3ea8ae8194dd889abce358a0d54a7117e21, 
principalName=malvezzi, IPv4=151.41.173.100, IPv6=null, Unk=null, 
creationInstant=2025-01-29T08:06:22.612Z, 
lastActivityInstant=2025-01-29T08:06:33.955195127Z, 
authenticationResults=[AuthenticationResult{authenticationFlowId=authn/MFA, 
authenticatedPrincipal=*, 
authenticationInstant=2025-01-29T08:06:21.798Z, 
lastActivityInstant=2025-01-29T08:06:22.602Z, previousResult=true}]

in the former there are promising properties like:
activeResults 
{authn/MFA=AuthenticationResult{authenticationFlowId=authn/MFA, 
authenticatedPrincipal=*, 
authenticationInstant=2025-01-29T08:06:21.798Z, 
lastActivityInstant=2025-01-29T08:06:22.602Z, previousResult=true}}
or
intermediateFlows (this a dead end, because it is about the current auth 
flow, while I'm looking for details of previous ones).

However, I didn't find yet the subflows' information of the previous 
activeResults and not ever its authnContextClass, which let me thinking 
I am looking in the wrong place.

The next step I would like to understand is the "enforce a custom 
timeout programmatically". First of all: wouldn't be enough just 
returning true of false as the reuseCondition is a predicate (where 
false means: do not reuse the SSO)? If not: to which object should I set 
the property inactivityTimeout?

thank you for the patience,

Francesco