title: Spring Security SAML assertion expiry with Application Session Expiry
body: <p>I'm getting confused with the SAML assertion expiry vs Application session expiry.</p>
  
  <p>In simple words, when we have an application deployed in a container, there is a session created. This session expiry can be controlled with the below entry in web.xml</p>
  
  <pre><code>&lt;session-config&gt;
      &lt;session-timeout&gt;60&lt;/session-timeout&gt;
  &lt;/session-config&gt;
  </code></pre>
  
  <p>Moving on, when I have Spring Security with SAML extension, obviously the same session concept applies. (I'm deploying the application in WildFly 8.2, if that matters)</p>
  
  <p>Further, when the application session expires, the logout behaviour seems to be equivalent to Local Logout concept.</p>
  
  <p>So far so good. Now lets say that the  SAML assertion is good for 2 hours and the user has been actively working for 2 hours. What should happen to the subsequent request then? Should it re-login to the IDP? But, wouldnt that be inconvenient to the user? If the application redirects to IDP for logging in again after 2 hours of assertion expiry, How should AJAX requests be handled?</p>
  
  <p>This is in reference to <a href="https://stackoverflow.com/questions/26047854/handling-saml-redirects-on-ajax-requests">the question here</a></p>