IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

The
session
cache
entry
lifetime
value
usually
determines
the
maximum
session
length.
When
this
lifetime
value
expires,
the
session
is
normally
terminated
regardless
of
activity.
However,
WebSEAL
can
be
configured
to
allow
the
user
to
reauthenticate
after
the
session
lifetime
value
has
expired.
After
successful
reauthentication,
the
lifetime
value
of
the
session
cache
entry
is
reset.
Two
other
conditions
can
end
a
user
session:
the
user
can
explicitly
log
out
or
an
administrator
can
terminate
a
user
session.
See
“Terminating
user
sessions”
on
page
345.
Configuration
is
available
to
reset
the
WebSEAL
session
cache
entry
lifetime
timer.
In
addition,
a
grace
period
can
be
configured
to
allow
sufficient
time
for
the
reauthentication
process
to
complete
before
the
lifetime
timeout
of
the
session
cache
entry
expires.
Enabling
inactivity
reauthentication
To
configure
WebSEAL
to
″flag″
inactive
sessions
rather
than
remove
them
from
the
session
cache,
set
the
value
for
the
reauth-for-inactive
parameter
to
″yes″
in
the
[reauthentication]
stanza
of
the
webseald.conf
configuration
file:
[reauthentication]
reauth-for-inactive
=
yes
The
default
value
for
this
parameter
is
″no″.
Resetting
and
extending
the
session
cache
entry
lifetime
value
Resetting
the
session
cache
entry
lifetime
value
The
user’s
session
cache
entry
has
a
limited
lifetime,
as
specified
by
the
timeout
parameter
in
the
[session]
stanza
of
the
webseald.conf
configuration
file.
The
default
value,
in
seconds,
is
3600
(1
hour):
[session]
timeout
=
3600
Regardless
of
session
activity
or
inactivity,
the
session
cache
entry
is
removed
when
the
lifetime
value
is
reached,
at
which
point
the
user
is
logged
off.
However,
you
can
configure
the
lifetime
of
the
session
cache
entry
to
be
reset
whenever
reauthentication
occurs.
With
this
configuration,
the
user
session
no
longer
has
a
single
maximum
lifetime
value.
Each
time
reauthentication
occurs,
the
session
cache
entry
lifetime
value
is
reset.
You
can
reset
the
lifetime
value
of
session
cache
entries
with
the
reauth-reset-lifetime
parameter
in
the
[reauthentication]
stanza
of
the
webseald.conf
configuration
file:
[reauthentication]
reauth-reset-lifetime
=
yes
The
default
value
is
″no″.
This
parameter
is
also
appropriate
for
reauthentication
due
security
(POP)
policy.
See
“Configuring
reauthentication
based
on
security
policy”
on
page
204.
Chapter
7.
Advanced
WebSEAL
authentication
209