> for apps is to verify periodically if a SAML session is still valid, if there’s a mechanism to do so. In general, that seems equivalent to the SP having a sh

> for apps is to verify periodically if a SAML session is still valid, if there’s a mechanism to do so. In general, that seems equivalent to the SP having a short session and the IdP having a long session. Suppose it's 1 hour and 8 hours. At 1h0m1s the next request to the SP causes a redirect to the IdP, and if the IdP hasn't heard about a sign out request, it just redirects back to the SP with a valid assertion that gives you another hour on the SP. No prompt to re-auth until the 8 hour mark.