I develop a lot of internal applications/websites for my work using our standard SSO. It uses SAML2 and has a few different levels of security available.
We have vendor who is using it for one of our internal CMSs. Basically you have to sign into SSO every day to access the site. You are just required to meet SSO authentication once per browser for almost all of the internal sites (the highest level ones require new authentication every time). The vendor/CMS is not at this level though, it just has basic SSO authentication.
So I make some config changes to vendor site and propagate them over the weekend. I need to check the changes on a bunch of different browsers. FF, Chrome, IE8, IE11, Safari, Android, Blackberry, Iphone...
I had to log into SSO each time... Until I try my iphone. I go to website and no redirect to SSO, I just get right in. I hadn't logged into the site on iphone in over a week. How could the iphone be passing back an authenticated cookie to the SSO?