Tutorial: How to Change the Web Session Timeout
This tutorial shows you how to configure the web session timeout settings for Access Server's web services.
Overview
When you authenticate to Access Server's Client Web UI or Admin Web UI, two configuration keys control how long your session stays active:
auth.sessiontoken.lifetime— the inactivity timeout. If a session is idle for longer than this value, it expires. The default is 600 seconds (10 minutes).auth.sessiontoken.max_renewaltime— the absolute maximum session age. Even if a user is actively using the web interface and their session is being continuously renewed, they are forced to re-authenticate once this limit is reached. The default is 14400 seconds (4 hours).
These two keys work together. A typical session ends at whichever limit is reached first — inactivity timeout or maximum renewal time. Configure both to match your organization's security requirements.
Prerequisites
An installed Access Server.
Console access and the ability to get root access.
From the Admin Web UI:
Sign in to the Admin Web UI.
Select Advanced. (You may need to select Proceed in the caution message.)
On the Config Editor tab, enter
auth.sessiontoken.lifetimein the search box and press Enter.The current value displays. If it hasn't been modified, the default is 600.
Clear the search box, enter
auth.sessiontoken.max_renewaltime, and press Enter.The current value displays. If it hasn't been modified, the default is 14400.
From the CLI:
Sign in to the console and get root privileges.
Run the following commands to see the current settings:
sacli ConfigQuery | grep -i "auth.sessiontoken.lifetime" sacli ConfigQuery | grep -i "auth.sessiontoken.max_renewaltime"
Note
If no value is returned for either key, the server is using the default values.
Set the inactivity timeout
This sets how long a session can be idle before it expires.
From the Admin Web UI:
On the Config Editor tab, select the edit icon for
auth.sessiontoken.lifetime.Enter a new Integer value in seconds. For example, enter
300for 5 minutes.Select Save and Restart.
From the CLI:
Set the inactivity timeout to five minutes (300 seconds):
sacli --key "auth.sessiontoken.lifetime" --value "300" ConfigPut sacli start
Set the maximum renewal time
This sets the absolute maximum age of a session, regardless of activity.
From the Admin Web UI:
On the Config Editor tab, select the edit icon for
auth.sessiontoken.max_renewaltime.Enter a new Integer value in seconds. For example, enter
28800for 8 hours.Select Save and Restart.
From the CLI:
Set the maximum session age to 8 hours (28800 seconds):
sacli --key "auth.sessiontoken.max_renewalttime" --value "28800" ConfigPut sacli start
Reset the inactivity timeout
From the Admin Web UI
On the Config Editor tab, select the edit icon for
auth.sessiontoken.lifetime.Select the Default setting checkbox.
The value reverts to 600.
Select Save and Restart.
From the CLI:
Remove the key so it resets to its default:
sacli --key "auth.sessiontoken.lifetime" ConfigDel sacli start
Reset the maximum renewal time
From the Admin Web UI:
On the Config Editor tab, select the edit icon for
auth.sessiontoken.max_renewaltime.Select the Default setting checkbox.
The value reverts to 14400.
Select Save and Restart.
From the CLI:
Remove the key so it resets to its default:
sacli --key "auth.sessiontoken.max_renewaltime" ConfigDel sacli start