and more in a single search tool across platforms. Read the announcement here. |
01/10/2024 08:13 AM
Hello, as some background, we have a custom SSO IdP configured for user authentication to our Saviynt environments. I'm attempting to set the user inactivity timeout settings in Saviynt and had questions on how a few of these properties / preferences work together.
We have the "grails.plugin.springsecurity.saml.maxAuthenticationAge" property in the AuthenticationConfig.groovy file and the "Http Session Time Out In Minute(s)" global preference configured as desired, but users are still getting timed out sooner than expected in some cases.
Does the "Http Session Time Out In Minute(s)" global preference setting override the SSO provider's inactivity timeout settings?
For example, if we configure that "Http Session Time Out In Minute(s)" preference to an hour, but the SSO provider's default inactivity timeout setting is configured for 10 minutes, does the SSO win and time a user out from Saviynt after 10 minutes of inactivity?
Solved! Go to Solution.
01/10/2024 06:50 PM
idp & authentication groovy config is for SSO whereas after Saviynt has been logged in either via SSO / Basic authentication then 30 minutes is http session timeout for saviynt
grails.plugin.springsecurity.saml.maxAuthenticationAge | Specify the maximum duration (in seconds) users can log in with SSO after initial authentication through the IdP. Note: The maxAuthenticationAge value must be lesser than or equal to the session logout value defined in the IdP. Example: 86000 |
https://saviynt.freshdesk.com/support/solutions/articles/43000661162-saml-metadata-files
01/11/2024 08:55 AM - edited 01/11/2024 08:56 AM
Thanks! To make sure I'm understanding it right, the property that controls session inactivity time outs once a user is logged into Saviynt would be that "Http Session Time Out In Minute(s)", correct?
(With the maxauthenticationage property controlling how long their session can last regardless.)
01/11/2024 12:30 PM
Yes