force_authn flag

[sylido]

Hi, it seems like when I try to set this flag to true and then pass it to the create_login_request_url it doesn't do what I expect it to do. My expectation was that the first time the user has to type in their login credentials into the idP server's page. Then they get logged out using the create_logout_request_url as the user visits it, the SAML session is terminated and the user will be completely logged out if they close all their browser windows. This forces the user to re-authenticate by typing in their credentials next time.

I was hoping that force_authn would allow me to skip the "close all the browsers" step in a way, by just requiring the user to re-authenticate with the idP again, even though they are logged in. Is it a mistake in my expectations or is the flag just not working ?

I am using a custom fork from 1.11.1, but looking through the updates I didn't see anything that might affect the behavior of the flag - I'll try and update my fork with the most recent changes anyways though.

Thanks !