Modifying session timeout for content authors not working

Question

We are working on Sitecore 10.2 Instance, where we want the Content Author to be logged out after 5 minutes of inactivity.

For that, we have made the changes in the below files, but it didn’t work:

Web.Config :

Sitecore.Owin.Authentication.config

I also followed the below thread but it didn't work for me on Sitecore 10.2.

How do I set session timeouts in Sitecore?

Answer 1

I found the solution to this by updating two values in the following file in the identity server.

wwwroot\<your-identity-server>\sitecore\Sitecore.Plugin.IdentityServer\Config\identityServer.xml

So you need to update the Identity Token to update the logout time. Here are steps.

You need to udpate the IdentityTokenLifetimeInSeconds, so in my case I updated it to 60 seconds like below. 

<IdentityTokenLifetimeInSeconds>60</IdentityTokenLifetimeInSeconds>

I also find out one more property by the help of comments given in this config i.e. CookieLifetime. So I updated it like below. 

<!-- Sets the identity server cookie lifetime -->
<CookieLifetime>0.00:01:00</CookieLifetime>

Finally you need to restart the Sitecore Identity Server so that the updated configuration is consumed on startup.

And it worked. User was able to logout after a minute.

I referred to this article to identify.

https://andrewsutherland.azurewebsites.net/2020/03/15/sitecore-identity-server-increasing-the-token-lifetime-for-local-development/

And then I wrote this article with all the details.

https://sbhatiablogs.wordpress.com/2023/02/23/how-to-change-sitecore-identity-server-logout-time/

Hope this helps.

Answer 2

You can check by opening your Sitecore instance URL like local.Sitecore.Com/sitecore/admin/showconfig.aspx, may be there is some patch config that is overriding your settings.

For reference you can use below link How do I set session timeouts in Sitecore?

Hope this helps you.

Answer 3

We are working on the Sitecore 10 version. Recently, we got a requirement where we need to update the logout time for Sitecore Admin users, so if they are not using it for more than 2 minutes then they should be logged out from the system.

Initially, we were updating some configuration changes in some configs in our Sitecore site directory but it was not solving the issue.

After investigating it more, we found that we need to update some settings in the configuration settings in the Sitecore Identity server site. And here is the solution that we found to do that. Follow these steps to do it.

1. Go to your Identity server website root and open the file called identityServer.xml from the below location.

wwwroot<your-identity-server>\sitecore\Sitecore.Plugin.IdentityServer\Config\identityServer.xml

2. Update the setting called IdentityTokenLifetimeInSeconds in seconds. For example, if I want to log out a user after 2 minutes, the setting will be like this.

120

3. There is another setting we found in this file i.e. CookieLifetime and added the time for 2 minutes. This setting sets the identity server cookie lifetime and should be used like this.

0.00:02:00

Finally, you need to restart the Sitecore Identity Server by going into IIS so that the updated configuration is consumed on startup.

That’s All. Now if you login into Sitecore and it is ideal for 2 minutes then it will perform the logout session after 2 minutes.

Hope it helps!

Credit: https://sbhatiablogs.wordpress.com/2023/02/23/how-to-change-sitecore-identity-server-logout-time/

Answer 4

I got this issue recently for Sitecore 10.3 and found out, apart from changing the settings that are mentioned here How do I set session timeouts in Sitecore?, we need to update the session time-out for client users in Sitecore Identity Server.

1. In the identityServer.xml file, find the setting called IdentityTokenLifetimeInSeconds. Modify this value to specify the desired session time-out duration in seconds. For example, if you want to log out a user after 5 minutes of inactivity, set the value to 300 seconds.

<IdentityTokenLifetimeInSeconds>300</IdentityTokenLifetimeInSeconds>

2. In the same identityServer.xml file, locate the CookieLifetime setting. Decrease the value of the CookieLifetime parameter (defines the lifetime of the authentication cookie on the IS side) to less than 5 minutes e.g.:

<CookieLifetime>0.00:04:00</CookieLifetime>

It needs to be done because if the authentication session expires on the Sitecore side, Sitecore redirects to the Identity Server, and, if the IS’s authentication cookie is not expired the user will be logged in to Sitecore again.

I have mentioned in my blog post why we need to set lesser time in CookieLifetime: https://sitecorewithraman.wordpress.com/2023/07/02/session-time-out-in-sitecore-managing-user-logout-and-expiration/