ShibRequestSetting forceAuthn true vs 1 vs on

[Scott Cantor]

> On Jun 5, 2026, at 12:28 PM, Dan McLaughlin <dmclaughlin at tech-consortium.com> wrote:
> 
> To clarify the timeout issue: it occurs when a user is proxied to the MFA provider and takes more than two minutes to enter their code and return to the SP. By that point, the SP session has expired, resulting in the error: "The gap between now and the time you logged into your identity provider exceeds the allowed limit."

There is (mostly) no SP limit, I assume you mean the IdP. But that is not 2 minutes, it's more like 15 or more, though it's up to you what it is, that's set in web.xml or more often globally.

Don't, FWIW, confuse SameSite issues with that. A SameSite mistake only breaks Chrome and that is 2 minutes.

-- Scott