<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'><br><div>> No. The AuthnInstance doesn't matter, SessionNotOnOrAfter is all that matters. That is the only relevant detail for the SP in session policy, and that's what causes the problem. The SP is doing what it's been told to do by the IdP.<br><br>> > As we see in the logs, SP expires the session at 2013-03-20 11:54:20. If the<br>> > session is being removed because the time period specified by IdP has<br>> > passed we would expect it to do after 2013-03-20T12:01:14Z. <br><br> <br>> That isn't what SessionNotOnOrAfter says, so that's not what I would expect.<br>> <br><br><br>Thanks Scott! <br><br>It was a mistake on my part to use the time <span>"NotOnOrAfter"</span> under <saml:Conditions>. If the SP will expire the session based on "SessionNotOnOrAfter" under <saml:<span><span class="bold highlight search-highlight">AuthnStatement</span></span>>, then the session should have expired at <span>2013-03-20T11:46:24Z, instead it expired at 11:54. Does the SP expire the session when some form of request is made? </span>In other words, SP checks expiry of session when user performs some action in the application that the SP is protecting?<br><br></div> </div></body>
</html>