<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
> <span style="color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.6667px;background-color:rgb(255, 255, 255);display:inline !important">Most
people proxying don't use the IdP's sessions, but if they're in use, there are no differences between any of the login flows in that respect, reuse is up to the relevant lifetime and your reuseCondition (if set).</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Thanks Scott, from this I assume that (in the SAML flow in isolation, no MFA flow calling it) there is also nothing stopping a new result from being loaded into a new session in the user's browser after the old one expires? (as it does in Password flow).</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
I can't see why this SAML flow can't load a new session/result after the first one expires, so unless I can find something outside the IdP causing this I may need to rethink the way the subsequent MFA orchestrator flow works based on these sessions not being
available..</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Out of interest, is there a way to set an individual flow to have no lifetime or timeout in its own properties? Or does this rejection of idp sessions need to be set globally in the idp.session.enabled?</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Thanks again,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
John</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Cantor, Scott <cantor.2@osu.edu><br>
<b>Sent:</b> 13 September 2022 15:30<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Cc:</b> John Watt <John.Watt@glasgow.ac.uk><br>
<b>Subject:</b> Re: SAML flow within MFA flow - possible c14n problem</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Most people proxying don't use the IdP's sessions, but if they're in use, there are no differences between any of the login flows in that respect, reuse is up to the relevant lifetime and your reuseCondition (if set).<br>
<br>
However, the MFA flow by design can't apply timeouts on the individual results, as noted in the documentation (under Single Sign-On / Reuse By the
<br>
MFA Flow).<br>
<br>
"Note that one feature the MFA flow does not have is individual timeouts. For various reasons, it was not practical to maintain an activity timeout on the individual results within the MFA flow, and so that check is not done. Using a shorter lifetime generally
will compensate for that.<br>
<br>
On the other hand, the overall MFA result that contains all of the individual results does have the normal lifetime/timeout policy the IdP supports. You can still time out any memory of any of the results, just not at a fine-grained level."<br>
<br>
-- Scott<br>
<br>
<br>
</div>
</span></font></div>
</body>
</html>