Add policy that forces SAML users to log in online periodically

components/policy/resources/policy_templates.json

Index: components/policy/resources/policy_templates.json
diff --git a/components/policy/resources/policy_templates.json b/components/policy/resources/policy_templates.json
index eca3c68b5a3ae6a6b03e2c87332b85489f5d5725..ed75d846eda2e9729966e23154ffa7e17996e483 100644
--- a/components/policy/resources/policy_templates.json
+++ b/components/policy/resources/policy_templates.json
@@ -118,7 +118,7 @@
 #   persistent IDs for all fields (but not for groups!) are needed. These are
 #   specified by the 'id' keys of each policy. NEVER CHANGE EXISTING IDs,
 #   because doing so would break the deployed wire format!
-#   For your editing convenience: highest ID currently used: 252
+#   For your editing convenience: highest ID currently used: 253
 #
 # Placeholders:
 #   The following placeholder strings are automatically substituted:
@@ -3492,6 +3492,30 @@
       If the policy is set to disabled or left not set signing in leads to regular profiles.'''
     },
     {
+      'name': 'SAMLOfflineSigninTimeLimit',
+      'type': 'int',
+      'schema': { 'type': 'integer', 'minimum': -1 },
+      'supported_on': ['chrome_os:34-'],
+      'features': {
+        'dynamic_refresh': True,
+        'per_profile': True,
+      },
+      'example_value': 32,
+      'id': 253,
+      'caption': '''Limit the time for which a user authenticated via SAML can log in offline''',
+      'desc': '''Limit the time for which a user authenticated via SAML can log in offline.
+
+      During login, Chrome OS can authenticate against a server (online) or using a cached password (offline).
+
+      When this policy is set to a value of -1, the user can authenticate offline indefinitely. When this policy is set to any other value, it specifies the length of time since the last online authentication after which the user must use online authentication again.
+
+      Leaving this policy not set will make <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> use a default time limit of 14 days after which the user must use online authentication again.
+
+      This policy affects only users who authenticated using SAML.
+
+      The policy value should be specified in seconds.''',
+    },
+    {
       'name': 'AutoCleanUpStrategy',
       'type': 'string-enum',
       'schema': {