Chrome OS Device Single Sign On (SSO) with 3rd Party IdP

Does anyone here have experience of putting a ChromeOS fleet (managed) behind Okta for SSO? 

We have the basic SSO working as expected, but we have challenges around controlling session lengths in particular.

• Our idea setup would be;
• User signs into the device with Okta (IdP)
• Session token is passed-through to the Chrome Browser
• The session is valid for 12hrs (matching our Okta Global Session Policy)
• At the end of the 12hrs the user is logged out of the session and asked to re-authenicate via Okta (IdP)
• Sleep wakes and Lid-Close & Open wakes are password only within the 12hrs

For some reason we just can’t reach this configuration, there is always one blocker or another no matter what configuration combination we try.

The easiest finger to point is that the controls for re-authorising SSO/SAML (SAML Single Sign On Login Frequency) aren’t granular enough, there is no intermediate between 1 day and Always. But we are open to any ideas.

We have however tried many things including forcing restarts etc, however its difficult (impossible) to get the timings to align.

Any suggestions would be greatly appreciated.