Session Settings
Session Settings define how long user sessions remain active and how long access tokens are valid. The settings apply to both local login sessions and SSO sessions.
Where to find the settings
Navigate to:
Configuration → Global → Access Management → Session Settings
The current configuration is displayed in the Session Settings section. Select the edit icon to change the settings.
Available settings
The following session settings can be configured:
| Setting | Description |
|---|---|
| Idle Session Timeout | Defines how long a session can remain inactive before it expires. |
| Maximum Session Timeout | Defines the maximum duration of a session, regardless of user activity. |
| Access Token Lifespan | Defines how long an issued access token remains valid. |
For each setting, the duration can be configured in seconds, minutes, hours, or days.
Idle Session Timeout
The Idle Session Timeout defines how long a session can remain inactive.
If no activity occurs within the configured period, the session expires and the user must authenticate again.
Example:
If the Idle Session Timeout is set to 30 minutes, the session expires after 30 minutes without activity.
Maximum Session Timeout
The Maximum Session Timeout defines the maximum overall duration of a session.
Unlike the Idle Session Timeout, this value applies regardless of user activity. Once the configured duration is reached, the session expires and the user must authenticate again.
Example:
If the Maximum Session Timeout is set to 10 hours, the session expires after 10 hours even if the user has remained active.
Access Token Lifespan
The Access Token Lifespan defines how long an issued access token remains valid.
After the configured duration, the access token expires. As long as the associated session is still valid, authentication can continue based on the active session.
Example:
If the Access Token Lifespan is set to 5 minutes, an issued access token is valid for up to 5 minutes.
Configuration rules
The configured values must follow the applicable session rules. Invalid combinations cannot be saved.
For example, the Access Token Lifespan should be shorter than the Idle Session Timeout.
The Webportal displays validation messages if the configured values do not meet the required rules.
Updated about 2 hours ago