<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body dir="ltr">
<style type="text/css" style="display:none"><!-- p {margin-top:0;margin-bottom:0;} --></style>
<div dir="ltr" style="outline: medium none; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-family: Calibri,Arial,Helvetica,sans-serif; display: block;" useinlinestyle="true" role="textbox" class="">
Hello,<br>
<br>
I think from the documentation this is not possible, but I wanted to verify: we have a request from one SP, that protects more sensitive data, to enforce a different session timeout at the IDP level, i.e. when that SP forwards users to the IDP it only respects
sessions that started within the last 59 minutes, versus all the other SPs that have the default of 8 hours. From what I'm seeing in the documentation, there is just one IDP session for all requests.<br>
<br>
If that's correct, I'm supposing the best practice here is for this special SP to have the forceAuth flag set to true and apply its own sessions for only 1 hour, i.e. this SP is not part of the normal SSO contract since it considers itself special? Does that
sound right?<br>
<br>
Sorry for the basic question. Any help would be appreciated.<br>
<br>
Sean<br>
</div>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<title>JWT 150</title>
<p style="font-family: 'Calibri', arial, sans-serif; font-size: 9px;">This transmission is intended solely for the person or organization to whom it is addressed and it may contain privileged and confidential information. If you are not the intended recipient
you should not copy, distribute or take any action in reliance on it. If you believe you received this transmission in error please notify the sender.
</p>
</body>
</html>