Tutorial: How to Change the Web Session Timeout⁠

Overview⁠

When you authenticate to Access Server's Client Web UI or Admin Web UI, two configuration keys control how long your session stays active:

auth.sessiontoken.lifetime — the inactivity timeout. If a session is idle for longer than this value, it expires. The default is 600 seconds (10 minutes).
auth.sessiontoken.max_renewaltime — the absolute maximum session age. Even if a user is actively using the web interface and their session is being continuously renewed, they are forced to re-authenticate once this limit is reached. The default is 14400 seconds (4 hours).

These two keys work together. A typical session ends at whichever limit is reached first — inactivity timeout or maximum renewal time. Configure both to match your organization's security requirements.

Prerequisites⁠

An installed Access Server.
Console access and the ability to get root access.

From the Admin Web UI:⁠

Sign in to the Admin Web UI.
Select Advanced. (You may need to select Proceed in the caution message.)
On the Config Editor tab, enter auth.sessiontoken.lifetime in the search box and press Enter.
The current value displays. If it hasn't been modified, the default is 600.
Clear the search box, enter auth.sessiontoken.max_renewaltime, and press Enter.
The current value displays. If it hasn't been modified, the default is 14400.

From the CLI:⁠

Sign in to the console and get root privileges.
Run the following commands to see the current settings:
```
sacli ConfigQuery | grep -i "auth.sessiontoken.lifetime"
sacli ConfigQuery | grep -i "auth.sessiontoken.max_renewaltime"
```
Note
If no value is returned for either key, the server is using the default values.

Set the inactivity timeout⁠

This sets how long a session can be idle before it expires.

From the Admin Web UI:⁠

On the Config Editor tab, select the edit icon for auth.sessiontoken.lifetime.
Enter a new Integer value in seconds. For example, enter 300 for 5 minutes.
Select Save and Restart.

From the CLI:⁠

Set the inactivity timeout to five minutes (300 seconds):

sacli --key "auth.sessiontoken.lifetime" --value "300" ConfigPut
sacli start

Set the maximum renewal time⁠

This sets the absolute maximum age of a session, regardless of activity.

From the Admin Web UI:⁠

On the Config Editor tab, select the edit icon for auth.sessiontoken.max_renewaltime.
Enter a new Integer value in seconds. For example, enter 28800 for 8 hours.
Select Save and Restart.

From the CLI:⁠

Set the maximum session age to 8 hours (28800 seconds):

sacli --key "auth.sessiontoken.max_renewalttime" --value "28800" ConfigPut
sacli start

Reset the inactivity timeout⁠

From the Admin Web UI⁠

On the Config Editor tab, select the edit icon for auth.sessiontoken.lifetime.
Select the Default setting checkbox.
- The value reverts to 600.
Select Save and Restart.

From the CLI:⁠

Remove the key so it resets to its default:

sacli --key "auth.sessiontoken.lifetime" ConfigDel
sacli start

Reset the maximum renewal time⁠

From the Admin Web UI:⁠

On the Config Editor tab, select the edit icon for auth.sessiontoken.max_renewaltime.
Select the Default setting checkbox.
- The value reverts to 14400.
Select Save and Restart.

From the CLI:⁠

Remove the key so it resets to its default:

sacli --key "auth.sessiontoken.max_renewaltime" ConfigDel
sacli start

Can't find what you're looking for?

Our support team will be happy to assist you.

Contact Support Schedule a Demo

Tutorial: How to Change the Web Session Timeout⁠

Overview⁠

Prerequisites⁠

Was this information helpful?