Add policy that forces SAML users to log in online periodically

components/policy/resources/policy_templates.json

Index: components/policy/resources/policy_templates.json
diff --git a/components/policy/resources/policy_templates.json b/components/policy/resources/policy_templates.json
index 37bca321ee4f33ad8c17e8e07d1030560c5881fc..df09c8d9ca189dbd110badee0e5fca3f54eb846c 100644
--- a/components/policy/resources/policy_templates.json
+++ b/components/policy/resources/policy_templates.json
@@ -118,7 +118,7 @@
 #   persistent IDs for all fields (but not for groups!) are needed. These are
 #   specified by the 'id' keys of each policy. NEVER CHANGE EXISTING IDs,
 #   because doing so would break the deployed wire format!
-#   For your editing convenience: highest ID currently used: 253
+#   For your editing convenience: highest ID currently used: 254
 #
 # Placeholders:
 #   The following placeholder strings are automatically substituted:
@@ -3557,6 +3557,30 @@
       If the policy is set to disabled or left not set signing in leads to regular profiles.'''
     },
     {
+      'name': 'SAMLOfflineSigninTimeLimit',
+      'type': 'int',
+      'schema': { 'type': 'integer', 'minimum': -1 },
+      'supported_on': ['chrome_os:34-'],
+      'features': {
+        'dynamic_refresh': True,
+        'per_profile': True,
+      },
+      'example_value': 32,
+      'id': 254,
+      'caption': '''Limit the time for which a user authenticated via SAML can log in offline''',
+      'desc': '''Limit the time for which a user authenticated via SAML can log in offline.
+
+      During login, Chrome OS can authenticate against a server (online) or using a cached password (offline).
+
+      When this policy is set to a value of -1, the user can authenticate offline indefinitely. When this policy is set to any other value, it specifies the length of time since the last online authentication after which the user must use online authentication again.
+
+      Leaving this policy not set will make <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> use a default time limit of 14 days after which the user must use online authentication again.
+
+      This policy affects only users who authenticated using SAML.
+
+      The policy value should be specified in seconds.''',
+    },
+    {
       'name': 'AutoCleanUpStrategy',
       'type': 'string-enum',
       'schema': {