SAML2 session timeout settings overwritten

[sychan]

I am trying to customize the session timeouts per the description here:

http://wiki.service-now.com/index.php?title=Installation_Exits

The appropriate place seemed to be the Process handler in the SAML2 login script. I've added in the code to set the session timeout based on source IP address, and it all seems to run without issues. But the timeouts are not being honored. What I see in the logs is that the original session is being destroyed and a new one replaces it, and at that time another session timeout is applied (apparently from the glide.ui.session_timeout property).

03/07/12 09:35:52 (082) 2D569FBA00AC2000545B40D65BDAC928 *** Script: Here is where we would set the session duration for client IP 128.55.19.238
03/07/12 09:35:52 (085) 2D569FBA00AC2000545B40D65BDAC928 *** Script: IP Address matches 128.55.* - setting 10 hour session duration
03/07/12 09:35:52 (095) 2D569FBA00AC2000545B40D65BDAC928 Session destroyed: 2D569FBA00AC2000545B40D65BDAC928, (not logged in), created Wed Mar 07 09:35:38 PST 2012
03/07/12 09:35:52 (095) 2D569FBA00AC2000545B40D65BDAC928 Inactivity time changed from 1800 seconds to 7200 seconds

Is there a way to propagate the desired session timeout past this session recreation? I tried setting the glide.ui.session_timeout property from within the login script, but it doesn't seem to be honored.

Thanks,
Steve

[john_andersen]

I don't know that. I don't think you are exceeding the max value if there is one.

I would suggest two things in your case
1) Test with a 30 second value in your installation exit (this will help disregard issues with the longer timeout value you are using)
2) Test with your installation exit timeout being shorter than your global timeout property just to make sure that the global timeout doesn't win over the personal timeout when the global expires.

Where it seems to work fine for me, it is hard to provide much else for information on my end. I think those test are your next best step.

[Gaurav Bajaj]

Hello,

I am facing similar issue here as the session timeout set through installation exit is always overwritten by the default timeout(if property for timeout is absent) or the

session timeout property.

i checked it in the session cookies in browser console as well.

Please help me if someone got this issue rectified on their end.

Thanks

Gaurav Bajaj

[Community Alums]

If you're using SAML 2.0 you should set glide.ui.rotate_sessions to false