I'm designing a Canvas app for a new Salesforce org and have some questions about SSO and session timeout. 

Situation:

(1) The canvas app should not grant an user access based on a signed request along, but need to be protected with user authentication, right? 

(2) The Salesforce org and the canvas app can share the same IDP. So Salesforce is a Service Provider (SP); the canvas app is another SP. 

(3) The Salesforce, the canvas app, and the IDP each has their own session timeout. 

(4) If the user logins to Salesforce and visit the page with the canvas app before IDP session timeout, the login will be seamless, right?

(5) If an user logins to Salesforce via the IDP and keeps working on pages not using the canvas app, the Salesforce session is alive, but the IDP session will timeout, right?

(6) Then when the user gets to the page with the canvas app, the user has to login via the IDP again.

(7) For the users, would it appear that SSO works sometimes (when if they visit the canvas app soon after they login to Salesforce), does not work sometimes (if they visit the canvas app after IDP session times out). 

Questions:

(8) Is my analysis of the SSO behavior correct?

(9) Is there a way to keep the IDP session active while the user is working on one of the SP? 

Thanks for sharing your insights!