In previous versions of WSO2 Identity Server, the default time period for a SSO session is 10 hours and this default SSO Session Expire time value cannot be changed according to the user's needs. However, from WSO2 IS 5.1.0 onwards, a global configuration is specified in the identity.xml file (as explained below) and the SSO session timeout can be configured tenant wise using the management console.
The global configuration can be found in the <IS_HOME>/repository/conf/identity/identity.xml file under the <TimeConfig> element.
<TimeConfig>
<SessionIdleTimeout>15</SessionIdleTimeout>
<RememberMeTimeout>20160</RememberMeTimeout>
</TimeConfig>
To configure the Session Timeout and Remember Me period tenant wise, follow the steps below:
- Start the IS server and login to the management console.
- Go to Identity Providers>List under the Main menu and click on Resident Identity Provider.
- Fill in the fields as seen below to configure the session timeout and RememberMe period.
- Restart the server to save the changes
Now the SSO session is timed out according to the newly configured value and users need to be re-authenticated once the session times out. If a timeout is not configured, the SSO session simply uses the 15 minutes default time out value.
- After configuring the session timeout, see the Configuring Inbound Authentication for a Service Provider page to setup Single Sign On with WSO2 Identity Server.
- See Single Sign-On for more information.