User inactivity timeout settings question

[sjordheim23]

Hello, as some background, we have a custom SSO IdP configured for user authentication to our Saviynt environments. I'm attempting to set the user inactivity timeout settings in Saviynt and had questions on how a few of these properties / preferences work together. 

We have the "grails.plugin.springsecurity.saml.maxAuthenticationAge" property in the AuthenticationConfig.groovy file and the "Http Session Time Out In Minute(s)" global preference configured as desired, but users are still getting timed out sooner than expected in some cases.

Does the "Http Session Time Out In Minute(s)" global preference setting override the SSO provider's inactivity timeout settings?

For example, if we configure that "Http Session Time Out In Minute(s)" preference to an hour, but the SSO provider's default inactivity timeout setting is configured for 10 minutes, does the SSO win and time a user out from Saviynt after 10 minutes of inactivity?

[rushikeshvartak · Accepted solution]

idp & authentication groovy config is for SSO whereas after Saviynt has been logged in either via SSO / Basic authentication then 30 minutes is http session timeout for saviynt 

grails.plugin.springsecurity.saml.maxAuthenticationAge

Specify the maximum duration (in seconds) users can log in with SSO after initial authentication through the IdP. Note: The maxAuthenticationAge value must be lesser than or equal to the session logout value defined in the IdP. Example: 86000

https://saviynt.freshdesk.com/support/solutions/articles/43000661162-saml-metadata-files 

https://docs.saviyntcloud.com/bundle/Internal-Resources/page/Content/Handbooks/Handbook-for-v2021-0-... 

[sjordheim23]

Thanks! To make sure I'm understanding it right, the property that controls session inactivity time outs once a user is logged into Saviynt would be that "Http Session Time Out In Minute(s)", correct?

(With the maxauthenticationage property controlling how long their session can last regardless.)

[rushikeshvartak]

Yes