title: Is ForceAuthn=true good idea for Service Provider
body: <p>Looking for guidance to understand the use case behind <code>ForceAuthn=true</code> for SAML-driven Single Sign-On.</p>
  <p>We know that <code>ForceAuthn=true</code> will always challenge the user for credentials which creates friction thus negative experience for the user.</p>
  <p>However, that's UX story. What about security?</p>
  <p>If <code>ForceAuthn=false</code>, I authenticate once and the second time a seamless login will happen.</p>
  <p>This might create an issue where unware user using public PC can leave the access open for the next person.</p>
  <p>If you have are (or work) for a provider (e.g. SaaS) and have SAML-driven SSO with clients, what is your policy/experience around this topic?</p>