Implementing Canvas Session Timeout

[Scott Cantor]

> On Jul 29, 2026, at 3:24 PM, Timothy Spear <n614cd at gmail.com> wrote:
> 
> I am willing to bet Scott knows this better than I do.
> But, in the SAML protocol technically the IdP can send session refresh, length and other values to the SP. 

Length only, as advice, yes, as I said. It is not mandatory to respect it. There is one field related to this, nothing more.

> However, I have never seen an SP respect them. 

Mine does (not shocking, I know).

-- Scott