This is probably a design/architectural question. My app uses RSA initiated SSO using SAML for authentication and from there on my app uses its own session to manage the request. There is a flaw in this design - if the user signed out of the RSA, my app session is still active.
How to check the RSA session is active in every request? Does Spring security provide any out of box solution for this?