How to handle expired SAML auth_request
We are running our J2EE web based application on Oracle Weblogic 12.2.1.4.0 and have it
setup as SAML Service Provider with Keycloak 25 being the Identity Provider.
We have implemented SP initiated SSO, so WLS generates a SAML authentication requests including an ID that expires after 300 secs.
Now if the user of our application logs in through Keycloak and for some reason completes the login activity in more than 300 secs, the auth_request ID is expired and already removed from the cache and the user receives a "HTTP 500" error page. At the same time the log files reports: <[Security:096554]Cannot find request for InResponseTo: _b3af4bcd-c3fe-4c9b-b0d4-01a9af20fedc in response