title: How to validate external IDP session after x minutes?
body: <p>I'm working on a SaaS offering, and we are using IdentityServer 3 for authentication.
  To support Single Sign On with external identity providers, we are using SAML2p with Sustainsys Saml2 Owin middleware, so that IdentityServer is the SP.</p>
  
  <p>However, after signing in with the external IDP, we would like to validate the external identity periodically, or at least after some given time.
  Say you have signed in using Active Directory Federation Services (ADFS), you are authenticated, and are working in the software. Then someone decide you are no longer a valid user in the organization (fired), and disable your user in their AD.
  How long could you then still continue working in the software without being validated with the IDP/ADFS? The IdentityServer session is 60 min, but of course sliding. Will it slide forever? Is there a way to configure this?</p>
  
  <p>There are methods in Idsrv where we could do some checkups, like in the IAuthenticationSessionValidator. Someone suggested to call userinfo endpoint, but not all IDPs are OpenID Connect compliant or have such endpoints.
  I would like something generic, we don't control the external provider. And we plan to support WS-Fed and OpenID Connect also.</p>
  
  <p>I found this question, but it didn't really have the answer I'm looking for:
  <a href="https://stackoverflow.com/questions/47113383/sso-should-sp-validate-session-with-idp-in-every-request">SSO : Should SP validate session with IDP in every request</a> </p>
  
  <p>It would be great if there is a way to configure an interval or rule to redirect to the external IDP to validate the session? Redirecting on every request seems too much. (I don't even know how to do that)</p>