Reauthentication
Reauthentication repeats some or all of an authentication process to re-establish that a person is present in an authenticated session.
Signing in again is not always signing in more strongly
Reauthentication checks continued presence after an earlier sign-in. Depending on the requirements, it may repeat only part of the original process. Step-up authentication asks for stronger authentication. They can happen together, but a fresh authentication does not have to be stronger.
NIST distinguishes an overall session timeout from an inactivity timeout. Keeping a session active is not the same as authenticating again. It also separates application and identity-provider sessions: ending one does not automatically end the other.
With single sign-on, an application may get a new assertion from an existing identity-provider session without the user actively signing in again.
A new token can describe an old authentication
Suppose an application requires recent authentication before a sensitive export. A newly issued ID token is not enough to show the user just authenticated. Check the authentication time.
OpenID Connect’s max_age requests a maximum time since active authentication. When it is used, the returned ID token must include auth_time. The application still needs to validate the response and check that the authentication is recent enough.