User isn't logged out after SAML Session Idle Timeout or Session Maximum Age is reached

• Type: Regression Bug
• Status: Closed
• Resolution: Won't Fix
• Affects Version/s: 7.2.X, Master
• Fix Version/s: None
• Component/s: Application Security > SAML
• Labels:
  • SMEQAFP3
  • sme-must-7.2
• Fix Priority: 4

Steps to reproduce:

1. Setup IdP and SP
2. On Identity Provider page, set the Session Idle Timeout to 180 and the Session Maximum Age to 300
3. Log out and log back in
4. Idle for 3 minutes (180 seconds)
5. Wait another 2 minutes (300 seconds total)

Expected result:
Expected to be logged out at Step 4 and Step 5

Actual result:
User is still logged in. 

Reproduced on:
Tomcat 9.0.10 + MySQL 5.7.25
Portal master-private GIT ID: a9592e2d7fea42208023d053f0e6fedf4f6a2380