Discussion between user1263981 and Hugh Wood

Stack Exchange

14:40

A: Session timeout doesn't work for FBA sites - sharepoint 2010

The point you need to set is the timeout value for your cookie in your forms configuration of your web config. Once expired the user will be logged out. 1200 = 20 minutes. Hope this is enough for what you are looking for. <authentication mode="Forms" > <forms loginUrl="~/Account/SignIn" timeo...

user1263981

I have tried your solution but no success

Does session timeout work on local domain? I am testing FBA website on our local domain.

We are using FBA with LDAP environments.

Is timeout = 20 mins or 1200 sec? as per msdn i think it should be set to mins msdn.microsoft.com/en-us/library/1d3t3c61(v=vs.71).aspx

Hugh Wood

You are right sorry I presumed seconds "Specifies the amount of time, in integer minutes"

user1263981

I am just reading this following article on msdn [msdn.microsoft.com/en-us/library/hh147183](http://msdn.microsoft.com/en-us/library/hh147183)
1) Does it apply to my environment FBA with LDAP?
2) Is it worth using

$sts = Get-SPSecurityTokenServiceConfig
$sts.UseSessionCookies = $true
$sts.Update()
iisreset

Hugh Wood

Depends on what provider/how your authentication portal is configured if this would be supported. This is something I can't really help with. But it doesn't hurt to try if you have a test environment.

user1263981

We just like to achieve idle session timeout under FBA with LDAP environment. I was expecting this to be very simple and straight forward but don’t why it is not working. Should i post my web.config file of website.

Hugh Wood

14:40

More information about the whole FBA would be required, ie the portal vendor, if its custom etc etc, but basically it just needs the session cookies expiring after 20 minutes. This should be straight forward... But how many times have I said that about SP ;) Post as much detail as possible, the auth section of your webconfig and web app settings as well. Did you deactivate and reactivate your auth provider btw after config changes? If you don't settings wont apply.

user1263981

sorry i didn't get it. "Did you deactivate and reactivate your auth provider btw after config changes"

Hugh Wood

@user1263981 hey, in central admin web apps, you select the authentication provider in auth providers, if you unselect it and apply and reselect and apply the settings may then take effect. The code you posted for use session cookies will probably require this. Failing this depending on the portal you are using try and look through the configuration manual for cookie expiry settings.

user1263981

15:10

Okay, i have reconfig the authentication settings but still same results.

Hugh Wood

forms loginUrl="/_login/default.aspx" timeout="360" < surely that is 360 minutes according to the documentation you linked? Wouldn't this be 20? Or 1/2 for testing?

user1263981

sorry it is 6 (mins) not 360. In web.config file on certain places the execution timeout is set to 120 but session time out is 6.

Hugh Wood

Have you used a cookie inspector to check the cookies to see if the timeout is actually being set?

user1263981

15:30

I have used the IE developer tool to see the cookies information. It is bit strange because i logged on to website at 16:32 and cookies information showing 16:29 expires time. Is it normal?

Hugh Wood

Is the server time different to the client side time? The time is set server side.

user1263981

you are right there is a difference of about 3 mins. Machine time is wrong. Let me try again

What is meant by "EXPIRES" it is showing the time i logged in

Hugh Wood

expires should be the time the cookie expires, unless it has a timeout property which then would be the time the cookie was made

user1263981

I have tried IECookies software to test it. It looks like expire time is same as created time

Hugh Wood

is there any other properties

user1263981

15:46

Key , Value, Domain, Secure, Expires, Modified, IP, Sub Values

Hugh Wood

seems like a normal cookie nothing custom in the properties

user1263981

I can manually expire session by clearing session cookies in IE developer tool option

Hugh Wood

Okay so we know the practice of expiring cookies for fba is sound for your deployment, now just need to find out how to set the expiry. Perhaps there is an option in the portal?

user1263981

there is in General settings but it doesn't work. I set it to 6 mins

where is the following option is SP2010 Central Admin > Application Management > Office SharePoint Server Shared Services > Configure Session State

Hugh Wood

Is the fba login custom?

Thinking in the envelope that's passed is there anything that sets the session timeout and overriding sp settings?

user1263981

16:02

It is a FBA with LDAP and we are using default login page. Users are setup in AD.

Hugh Wood

There must be an article for this then, time to hit google.

user1263981