# security agent's session token for the IdP expired mid-audit: re-auth flow

## TL;DR

The audit ran longer than the IdP session lifetime, so calls started failing auth halfway through. Build re-auth into the long-running workflow: detect the expiry, re-authenticate (refresh or full flow), and resume from the checkpoint. Long jobs must survive session lifetimes.

```text
security agent's session token for the IdP expired mid-audit
```

## Steps

1. Detect the expiry distinctly from other auth failures: the error names the expired session.
   Expected: The cause is identified.

2. Re-authenticate: refresh the token if possible, else run the full flow.
   Expected: The session is valid again.

3. Resume from the audit checkpoint, not from the start.
   Expected: No work is repeated.

4. Add expiry handling to the audit loop: check token lifetime before each phase.
   Expected: The next expiry is handled inline.

5. Right-size the session lifetime for audit workloads, or break audits into session-sized chunks.
   Expected: The design fits the constraint.

## When to use

- long-running jobs fail auth midway
- the IdP session is shorter than the job
- audits run for hours

## When not to use

- the job is short (then the session should cover it; check the lifetime)
- the auth failure is at the start (different problem)
- the IdP supports non-expiring service credentials (use those)

## Tool compatibility

- any IdP
- long-running audit workflows

## Variant phrasings

- "session token expired mid-audit"
- "IdP session expired long job"
- "re-auth mid audit"

## Why it happens

IdP sessions are deliberately short-lived, but audits are deliberately long-running, and the two meet in the middle of the job. An agent without re-auth logic treats the expiry as a fatal error and loses hours of progress. Session lifetime is a known constraint; the workflow must be designed around it, with checkpoints making resume cheap.

## Edge cases

- the re-auth may need human interaction; have the runbook ready
- checkpoints must be durable across the re-auth
- the checkpoint interval bounds the repeated work on expiry

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_1a137Ts95z1vZ7xs-8wg_Q