[keycloak-user] SAML requires reauthentication

Scenario: Use SP initiated URL (same if I use IDP initiated) to log into Salesforce. Open new tab and use same URL and instead of passing right through it once again prompts to authenticate through Keycloak. This behavior occurs even in the same tab. I would expect the behavior to be that as long as the browser is open it should not prompt for credentials. Is there a setting somewhere that I missed?