in src/main/java/org/apache/sling/auth/saml2/impl/AuthenticationHandlerSAML2Impl.java [712:736]
void refreshAuthData(final HttpServletRequest request, final HttpServletResponse response,
final AuthenticationInfo authInfo) {
// get current authentication data, may be missing after first login
String token = getStorageAuthInfo().getString(request);
// check whether we have to "store" or create the data
final boolean refreshCookie = needsRefresh(token);
// add or refresh the stored auth hash
if (refreshCookie) {
long expires = System.currentTimeMillis() + this.sessionTimeout;
try {
token = tokenStore.encode(expires, authInfo.getUser());
} catch (InvalidKeyException | IllegalStateException | UnsupportedEncodingException | NoSuchAlgorithmException e) {
throw new SAML2RuntimeException(e);
}
if (token != null) {
getStorageAuthInfo().setString(request, token);
} else {
clearSessionAttributes(request);
}
}
}