The Sessions settings in ZTrust allow administrators to configure session durations, idle timeouts, and login limits. These configurations control how long users, clients, and offline sessions remain active or idle before expiration. Proper session management enhances both security and user experience.
Fig 3.9.9.a: Session, Session Management
SSO Session Idle
Description - The duration of inactivity before an SSO session expires. Tokens and browser sessions are invalidated when the session expires.
Default Behavior - Resets automatically upon authentication or token refresh.
Duration Unit - Minutes / Hours / Days
Fig 3.9.9.b: Session, SSO Session Idle time
SSO Session Max
Description - The maximum duration an SSO session can remain active, regardless of user activity. Once exceeded, both tokens and sessions are invalidated.
Default Behavior - If exceeded, users must re-authenticate.
Duration Unit - Minutes / Hours / Days
Fig 3.9.9.c: Session, SSO Session Maximum time and format
SSO Session Idle Remember Me
Description - Defines the idle timeout for Remember Me sessions. If unset, the standard SSO Session Idle value applies.
Default Behavior - Defaults to SSO Session Idle if not configured.
Duration Unit - Minutes / Hours / Days
Fig 3.9.9.d: Session, SSO Session Idle remember me
SSO Session Max Remember Me
Description - Sets the maximum duration for a Remember Me session before expiration.
Default Behavior - Defaults to SSO Session Max if not configured.
Duration Unit - Minutes / Hours / Days
c
Client Sessions
Client sessions control how long application-specific sessions remain active.
Description - Duration a client session can remain idle before expiration. Tokens are invalidated once expired.
Default Behavior - Defaults to SSO Session Idle if not set.
Duration Unit - Minutes / Hours / Days
Fig 3.9.9.f: Session, Client session idle time format
Client Session Max
Description - Maximum duration a client session can remain active, regardless of activity. Tokens are invalidated once expired.
Default Behavior - Defaults to SSO Session Max if not set.
Duration Unit - Minutes / Hours / Days
Fig 3.9.9.g: Session, Client session max time format
This refers to the maximum duration for which a Client Session remains active before expiration.
Tokens are invalidated once the session expires.
If not set, it defaults to the Standard SSO Session Max value.
You can adjust the values and select the duration unit from the dropdown menu as required.
Fig 3.9.9.g: Session, Offline session settings
Offline Session Idle
Description - The duration an offline session can remain idle before expiration. Offline tokens must be refreshed within this period to maintain validity.
Default Behavior - If not refreshed within the set duration, the session expires.
Duration Unit - Minutes / Hours / Days
Fig 3.9.9.h: Session, Offline session idle
Offline Session Max Limited
Description - A toggle setting:
• ON → Enables the Offline Session Max duration limit.
• OFF → Offline sessions expire only due to inactivity.
Default Behavior -Disabled by default
Duration Unit - N/A
Fig 3.9.9.i: Session, Offline session settings for maximum time limit
Offline Session Max
Description - The maximum duration an offline session remains active, regardless of user activity.
Default Behavior - Requires Offline Session Max Limited to be enabled.
Duration Unit - Minutes / Hours / Days
You can customize this duration and select the unit (Minutes, Hours, or Days) from the dropdown menu as per your requirements.
Fig 3.9.9.j: Session, Login settings
Login Timeout
Description - Maximum time allowed for a user to complete the login process. If exceeded, users must restart authentication.
Default Behavior - Recommended: 30 minutes
Duration Unit - Minutes / Hours / Days
Fig 3.9.9.k: Session, Login settings timeout
Login Action Timeout
Description - Maximum duration users have to complete login-related actions, such as updating passwords or configuring TOTP.
Default Behavior -Recommended: 5 minutes or more
Duration Unit - Minutes / Hours / Days
Fig 3.9.9.l: Session, Login action timeout
Save and Revert
Save → Click Save to apply the updated session configurations.
Revert → Click Revert to discard any unsaved changes.
