When you log in to Sitecore using the Identity Server, the value of the ExpireTimeSpan parameter gets overridden by the value from the cookieExp claim. The value of the claim in its turn depends on the IdentityTokenLifetimeInSeconds parameter that is configured on the side of the Identity Server.

• Please open the <identity server folder>/sitecore/Sitecore.Plugin.IdentityServer/Config/identityServer.xml file and set the desired timeout to the IdentityTokenLifetimeInSeconds parameter (for 5 minutes it should be 300).

  300

• Then, in the same file, decrease the value of the CookieLifetime parameter (defines the lifetime of the authentication cookie on the IS side) to 5 minutes or even less e.g.:

<CookieLifetime>0.00:04:00</CookieLifetime>

It needs to be done because if the authentication session expires on the Sitecore side, Sitecore redirects to the Identity Server, and, if the IS's authentication cookie is not expired the user will be logged in to Sitecore again.

• Restart the Identity Server.

• You may notice, that the content editor is still not logging out after a defined time because the Content Editor (only this application) performs keepalive requests that prevent cookie expiration. The functionality comes from the Sitecore.js file where you can find the following lines:

if (scForm.Settings && scForm.Settings.SessionTimeout) {
//Keep alive action should be performed earlier then session expires. That's why - 30 * 1000
var keepAliveTimeout = scForm.Settings.SessionTimeout - 30 * 1000;
} else {
if (window.console) {
console.warn("SessionTimeout not found in settings scForm.Settings");
}
keepAliveTimeout = 1200 * 1000 - 30 * 1000;
}
window.setInterval(scKeepAlive, keepAliveTimeout);

As you can see the keepalive interval relies on the session timeout, so to make sure that the Content Editor does not send such a request prior to cookie expiration, please set the session timeout bigger than the authentication cookie expiration time in <sessionState> node of the web.config file.

eg. In the below node of web.config, the value of timeout should be bigger than the ExpireTimeSpan node of App_Config/Sitecore/Owin.Authentication/Sitecore.Owin.Authentication.config

<sessionState mode="InProc" cookieless="false" cookieSameSite="None" timeout="5"

Refer to this blog for more details: https://sitecorewithraman.wordpress.com/2023/07/02/session-time-out-in-sitecore-managing-user-logout-and-expiration/

When you log in to Sitecore using the Identity Server, the value of the ExpireTimeSpan parameter gets overridden by the value from the cookieExp claim. The value of the claim in its turn depends on the IdentityTokenLifetimeInSeconds parameter that is configured on the side of the Identity Server.

• Please open the <identity server folder>/sitecore/Sitecore.Plugin.IdentityServer/Config/identityServer.xml file and set the desired timeout to the IdentityTokenLifetimeInSeconds parameter (for 5 minutes it should be 300).

    <IdentityTokenLifetimeInSeconds>300</IdentityTokenLifetimeInSeconds>

• Then, in the same file, decrease the value of the CookieLifetime parameter (defines the lifetime of the authentication cookie on the IS side) to 5 minutes or even less e.g.:

<CookieLifetime>0.00:04:00</CookieLifetime>

It needs to be done because if the authentication session expires on the Sitecore side, Sitecore redirects to the Identity Server, and, if the IS's authentication cookie is not expired the user will be logged in to Sitecore again.

• Restart the Identity Server.

• You may notice, that the content editor is still not logging out after a defined time because the Content Editor (only this application) performs keepalive requests that prevent cookie expiration. The functionality comes from the Sitecore.js file where you can find the following lines:

if (scForm.Settings && scForm.Settings.SessionTimeout) {
//Keep alive action should be performed earlier then session expires. That's why - 30 * 1000
var keepAliveTimeout = scForm.Settings.SessionTimeout - 30 * 1000;
} else {
if (window.console) {
console.warn("SessionTimeout not found in settings scForm.Settings");
}
keepAliveTimeout = 1200 * 1000 - 30 * 1000;
}
window.setInterval(scKeepAlive, keepAliveTimeout);

As you can see the keepalive interval relies on the session timeout, so to make sure that the Content Editor does not send such a request prior to cookie expiration, please set the session timeout bigger than the authentication cookie expiration time in <sessionState> node of the web.config file.

eg. In the below node of web.config, the value of timeout should be bigger than the ExpireTimeSpan node of App_Config/Sitecore/Owin.Authentication/Sitecore.Owin.Authentication.config

<sessionState mode="InProc" cookieless="false" cookieSameSite="None" timeout="5"

Refer to this blog for more details: https://sitecorewithraman.wordpress.com/2023/07/02/session-time-out-in-sitecore-managing-user-logout-and-expiration/