# 3.6 Sessions

#### What Is a Session in Ztrust?

Session is a data structure maintained by Ztrust that includes: Who is logged in, when they logged in, and which applications (clients) they have accessed during that login. There are two types:

* **User Session:**&#x20;
  * Created when a **user logs in** to ZTrust.
  * Tracks the user’s **identity**, **login time**, and all **clients/applications** they access during that session.
  * A single user session can cover **multiple client sessions**.
* **Client Session:**&#x20;

  * Represents a specific **login of a user to a particular client** (application).
  * **Multiple client sessions** can exist within a **single user session**.

  **Example**:\
  If a user logs into the realm and accesses three different apps, there will be **one user session** but **three client sessions**.

**How ZTrust Handles Sessions**

Whenever a user logs into a **realm**, ZTrust automatically:

* Creates a **user session** for that individual.
* Tracks **all clients** accessed by that user during that session.
* Maintains session information for authentication and Single Sign-On (SSO).

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FQff17J0GwBLOO4PvpsVs%2Fimage.png?alt=media&#x26;token=ce71dbb2-b7be-4646-bc16-fbab0c753b33" alt=""><figcaption></figcaption></figure>

### **Available Actions on User Sessions**

ZTrust provides several actions to manage user sessions effectively:

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FFAuCBo3FcFYaqpDUL9NE%2Fimage.png?alt=media&#x26;token=468b9ca6-af54-4a5b-82c9-44b43cf2cb18" alt=""><figcaption></figcaption></figure>

#### **1. Revocation**

* Allows you to **invalidate all active user sessions and access tokens**.
* Useful in case of:
  * **Security breaches**
  * **Policy changes**
  * **Forced logout requirements**
* When you click **Revocation**, you’ll see the following options:

  * **Not Before**
    * Sets a **cut-off date and time**.
    * Any session or token **issued before this time** will automatically become **invalid**.
  * **Set to Now**
    * Instantly sets the **current date and time** as the revocation point.
    * Any session issued **before now** becomes invalid.
  * **Clear**
    * Removes the **revocation date and time** if you no longer want to enforce it.
  * **Push**
    * Sends the **revocation policy** to all **registered OIDC clients** integrated via the **ZTrust Client Adapter**.
  * **Cancel**
    * Discards the changes and leaves sessions **unaffected**.

  <figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FaRyH2Q0dcGfiObHBsPYz%2Fimage.png?alt=media&#x26;token=0611b375-52b9-40cb-8d03-fb675c996738" alt=""><figcaption></figcaption></figure>

2. **Sign Out All Active Sessions:**

   Clicking **Sign out all active sessions** immediately:

   * Logs out **all users within the realm**.
   * Invalidates all **SSO cookies**.
   * Forces users to **log in again**.
