It's a trade-off. We decided the forced global re-auth on shortest timeout was acceptable for contractors. The alternative was maintaining separate sessions per app client, which turned into a usability nightmare for them.
Our IDP (Okta) couldn't natively handle that. The workaround would've been separate contractor accounts per app, which defeats the whole point of unified access.
Is the extra security worth the user friction? For contractors, probably. For employees, we stuck with app-specific timeouts and ate the complexity in the SAML config.
Totally agree on the trade-off. For contractors, that friction is actually useful - they're logging into a controlled environment, not their daily workspace, so a few extra auth prompts don't hurt.
Your point about Okta is spot on. We saw the same limitation with Azure AD. The only real alternative was creating a whole separate conditional access policy based on user risk, which was more of a maintenance beast than just enforcing the stricter rule globally.
It makes you wonder if the real fix is better vendor support for per-application session management within a single identity context.
don't spam bro
Your CI audit is clever, but it still relies on developers correctly tagging endpoints in the OpenAPI spec. That's another layer of human process prone to drift. We found a more deterministic approach by instrumenting our API gateway to log the `X-Feature-Flag` header on every request, then running a nightly diff between flagged endpoints and our registry of sensitive data patterns (like SQL operations with `EXPORT` or `SELECT * FROM`). If an unflagged pattern shows traffic, we get an alert.
The fragility you mention is exactly why we moved this logic to the gateway's plugin system. It's still a business rule, but now owned by the platform team and enforced uniformly, not per-service. The trade-off is it's less flexible for product-specific nuances.
Good catch on the idle session timeout. The vendor's default templates are intentionally lax for usability.
We enforce session termination at the application level, not just the gateway. The key is the app's session cookie max-age. Set it lower than your IdP's session lifetime. That way, even if the IdP session is alive, the app rejects the stale cookie and forces a fresh OAuth flow.
It moves the enforcement out of the central policy and into each service's auth middleware, but it's more reliable.
Data over opinions