Saml spec allows for a SessionNotOnOrAfter attribute inside the AuthnStatement and I see some getters/setters for that attribute in AuthnStatementType.java, but it doesn't look like it gets invoked anywhere, so we can't actually use it.

Were there any plans to give us a way to specify a value for this attribute, or just set it to the length of sso session max? I had some clients asking about it.

Jared