Increase Sitecore CMS timeout for content author [duplicate]

Question

I am using Sitecore 9.3 in Azure with Identity server. Content authors requested to increase their session timeout so that they can continue adding/editing content without interruptions.

I have seen many articles as specified below.

1. Sitecore session timeout
2. How do I set session timeouts in Sitecore?
3. Modifying session timeout for content authors not working
4. https://sbhatiablogs.wordpress.com/2023/02/23/how-to-change-sitecore-identity-server-logout-time/

..and implemented all the changes as specified. But none of them seems to work for me :(

The below is the list of changes i tried (Testing the timeout for 24 hours).

IdentityServer

<Authentication>
    <!-- Sets the identity server cookie lifetime -->
    <CookieLifetime>0.23:59:59</CookieLifetime>
</Authentication>

<Clients><DefaultClient>
          ….
          <IdentityTokenLifetimeInSeconds>86399</IdentityTokenLifetimeInSeconds>
          ….
</DefaultClient></Clients>

CM Server

a. Sitecore.Setting.Authentication.config

<setting name="Authentication.ClientSessionTimeout" value="1440" role:require="Standalone or ContentManagement"/>

b. Sitecore.Owin.Authentication.config

<processor name="CookieAuthentication" type="Sitecore.Owin.Authentication.Pipelines.Initialize.CookieAuthentication, Sitecore.Owin.Authentication" resolve="true" patch:source="Owin.Authentication.config">
<ExpireTimeSpan>0:23:59:59</ExpireTimeSpan>
</processor>

Web.Config

<authentication mode="None">
      <forms name=".ASPXAUTH" cookieless="UseCookies" timeout="1440" />
    </authentication>

Note: These changes are working great in a standalone installation but not working in Azure.

Any ideas/suggestions to fix this?

Answer 1

I have seen that you have tried lots of configurations as you mentioned in your question. As you are working with Azure, you can also try the following configurations.

• Open the Sitecore configuration file, wwwroot\<your-directory>\App_Config\Sitecore\Owin.Authentication.IdentityServer/Sitecore.Owin.Authentication.IdentityServer.config

• Inside the Azure AD identity provider section, you can add or modify the IdentityTokenLifetimeInSeconds setting to control the lifetime of identity tokens. For example:

  <identityProvider id="azuread" type="Sitecore.Owin.Authentication.IdentityProviders.OpenIDConnect.OpenIDConnectIdentityProvider, Sitecore.Owin.Authentication">
     <!-- Other settings here -->
    <param desc="identityTokenLifetimeInSeconds">3600</param>
  </identityProvider>
  

In above example, the identityTokenLifetimeInSeconds is set to 3600 seconds (1 hour). You can adjust this value to your preferred token lifetime.

• Save the configuration file.

• Restart your Sitecore instance to apply the changes.

Hope this will solve your issue.

Answer 2

When you log in to Sitecore using the Identity Server, the value of the ExpireTimeSpan parameter gets overridden by the value from the cookieExp claim. The value of the claim in its turn depends on the IdentityTokenLifetimeInSeconds parameter that is configured on the side of the Identity Server.

• Please open the <identity server folder>/sitecore/Sitecore.Plugin.IdentityServer/Config/identityServer.xml file and set the desired timeout to the IdentityTokenLifetimeInSeconds parameter (for 5 minutes it should be 300).

    <IdentityTokenLifetimeInSeconds>300</IdentityTokenLifetimeInSeconds>

• Then, in the same file, decrease the value of the CookieLifetime parameter (defines the lifetime of the authentication cookie on the IS side) to 5 minutes or even less e.g.:

<CookieLifetime>0.00:04:00</CookieLifetime>

It needs to be done because if the authentication session expires on the Sitecore side, Sitecore redirects to the Identity Server, and, if the IS's authentication cookie is not expired the user will be logged in to Sitecore again.

• Restart the Identity Server.

• You may notice, that the content editor is still not logging out after a defined time because the Content Editor (only this application) performs keepalive requests that prevent cookie expiration. The functionality comes from the Sitecore.js file where you can find the following lines:

if (scForm.Settings && scForm.Settings.SessionTimeout) {
//Keep alive action should be performed earlier then session expires. That's why - 30 * 1000
var keepAliveTimeout = scForm.Settings.SessionTimeout - 30 * 1000;
} else {
if (window.console) {
console.warn("SessionTimeout not found in settings scForm.Settings");
}
keepAliveTimeout = 1200 * 1000 - 30 * 1000;
}
window.setInterval(scKeepAlive, keepAliveTimeout);

As you can see the keepalive interval relies on the session timeout, so to make sure that the Content Editor does not send such a request prior to cookie expiration, please set the session timeout bigger than the authentication cookie expiration time in <sessionState> node of the web.config file.

eg. In the below node of web.config, the value of timeout should be bigger than the ExpireTimeSpan node of App_Config/Sitecore/Owin.Authentication/Sitecore.Owin.Authentication.config

<sessionState mode="InProc" cookieless="false" cookieSameSite="None" timeout="5"

Refer to this blog for more details: https://sitecorewithraman.wordpress.com/2023/07/02/session-time-out-in-sitecore-managing-user-logout-and-expiration/