> For the complete documentation index, see [llms.txt](https://ztrust.gitbook.io/ztrust-documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ztrust.gitbook.io/ztrust-documentation/user-manual-ztrust-v4.2/3.-guide-to-navigation/3.6-sessions.md).

# 3.6 Sessions

#### What Is a Session in Ztrust?

Session is a data structure maintained by Ztrust that includes: Who is logged in, when they logged in, and which applications (clients) they have accessed during that login. There are two types:

* **User Session:** 
  * Created when a **user logs in** to ZTrust.
  * Tracks the user’s **identity**, **login time**, and all **clients/applications** they access during that session.
  * A single user session can cover **multiple client sessions**.
* **Client Session:** 

  * Represents a specific **login of a user to a particular client** (application).
  * **Multiple client sessions** can exist within a **single user session**.

  **Example**:\
  If a user logs into the realm and accesses three different apps, there will be **one user session** but **three client sessions**.

**How ZTrust Handles Sessions**

Whenever a user logs into a **realm**, ZTrust automatically:

* Creates a **user session** for that individual.
* Tracks **all clients** accessed by that user during that session.
* Maintains session information for authentication and Single Sign-On (SSO).

<figure><img src="/files/1WCA5N9nnw0dD2IbyEtv" alt=""><figcaption><p>Fig 3.6.a: Sessions section in side bar</p></figcaption></figure>

### **Available Actions on User Sessions**

ZTrust provides several actions to manage user sessions effectively:

<figure><img src="/files/A9wmr3HH663Ll1bk3tUw" alt=""><figcaption><p>Fig 3.6.b: Actions on User Sessions</p></figcaption></figure>

#### **1. Revocation**

* Allows you to **invalidate all active user sessions and access tokens**.
* Useful in case of:
  * **Security breaches**
  * **Policy changes**
  * **Forced logout requirements**
* When you click **Revocation**, you’ll see the following options:

  * **Not Before**
    * Sets a **cut-off date and time**.
    * Any session or token **issued before this time** will automatically become **invalid**.
  * **Set to Now**
    * Instantly sets the **current date and time** as the revocation point.
    * Any session issued **before now** becomes invalid.
  * **Clear**
    * Removes the **revocation date and time** if you no longer want to enforce it.
  * **Push**
    * Sends the **revocation policy** to all **registered OIDC clients** integrated via the **ZTrust Client Adapter**.
  * **Cancel**
    * Discards the changes and leaves sessions **unaffected**.

  <figure><img src="/files/vqTMDdgvrsse3lx8E1KU" alt=""><figcaption><p>Fig 3.6.c: Configuration to revocation</p></figcaption></figure>

2. **Sign Out All Active Sessions:**

   Clicking **Sign out all active sessions** immediately:

   * Logs out **all users within the realm**.
   * Invalidates all **SSO cookies**.
   * Forces users to **log in again**.