Add policy that forces SAML users to log in online periodically

components/policy/resources/policy_templates.json

Index: components/policy/resources/policy_templates.json
diff --git a/components/policy/resources/policy_templates.json b/components/policy/resources/policy_templates.json
index 5b685e791ed79181de64c496a2c41382ceeabf74..3243bfec8000d9eac8b07189c4824eabbf46f984 100644
--- a/components/policy/resources/policy_templates.json
+++ b/components/policy/resources/policy_templates.json
@@ -118,7 +118,7 @@
 #   persistent IDs for all fields (but not for groups!) are needed. These are
 #   specified by the 'id' keys of each policy. NEVER CHANGE EXISTING IDs,
 #   because doing so would break the deployed wire format!
-#   For your editing convenience: highest ID currently used: 252
+#   For your editing convenience: highest ID currently used: 253
 #
 # Placeholders:
 #   The following placeholder strings are automatically substituted:
@@ -3432,6 +3432,30 @@
       If the policy is set to disabled or left not set signing in leads to regular profiles.'''
     },
     {
+      'name': 'SAMLOfflineSigninTimeLimit',
+      'type': 'int',
+      'schema': { 'type': 'integer', 'minimum': -1 },
+      'supported_on': ['chrome_os:34-'],
+      'features': {
+        'dynamic_refresh': True,
+        'per_profile': True,
+      },
+      'example_value': 32,
+      'id': 253,
+      'caption': '''Limit the time for which a user authenticated via SAML can log in offline''',
+      'desc': '''Limit the time for which a user authenticated via SAML can log in offline.
+
+      During login, Chrome OS can authenticate against a server (online) or using a cached password (offline).
+
+      When this policy is set to a value of -1, the user can authenticate offline indefinitely. When this policy is set to any other value, it specifies the length of time since the last online authentication after which the user must use online authentication again.
+
+      Leaving this policy not set will make <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> use a default value for the time limit after which the user must use online authentication again.

[dconnelly, 2014/01/23 08:40:56]

is this default value specified anywhere?

[bartfab (slow), 2014/01/23 09:47:23]

I had intentionally left it out because the default is not 100% decided yet. But
I see no harm in including it here. If we decide to change the defaults, I will
just update policy_templates.json.

Done.

+
+      This policy affects only users who authenticated using SAML.
+
+      The policy value should be specified in seconds.''',
+    },
+    {
       'name': 'AutoCleanUpStrategy',
       'type': 'string-enum',
       'schema': {