Skip to main content
This article applies only to Self-Managed and Dedicated Cloud environments. The shared environment (Shared Cloud) is managed by Authlete and is out of scope for this document.
The Security page sets the session policy for the environment. It’s available to Environment Admins and Platform Admins only.

​
Sessions

On the Session Management tab, you set two independent timeouts. Both apply to all users in the environment, regardless of which organizations they belong to.
  • Inactivity Timeout: the period of inactivity after which a user is automatically signed out. Enter the value in minutes. The default is 30 minutes.
  • Absolute Session Timeout: the maximum length of a session before re-authentication is required, regardless of activity. Enter the value in hours. The default is 24 hours.
Each value must be a positive number, and the absolute session timeout can’t be shorter than the inactivity timeout. Edit either value, then save. Discard restores the values that were last saved. In the shared environment, which Authlete manages, the session timeouts are fixed at the default values (30 minutes of inactivity and 24 hours absolute) and can’t be changed. Both timeouts terminate a session through the same shared path, which also revokes the associated Console access token, so the behavior is identical no matter which timer fires. Changes to either timeout are recorded in Audit Logs.
An absolute session-lifetime cap supports the session termination requirement in FedRAMP AC-12.