Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

Our SharePoint 2013 site will not log users out unless the browser is completely closed. We are using NTLM authentication but the site is hosted, so it is external accessible. We are afraid users will leave the browser open and their session/login will remain active indefinitely if the browser is not closed.

Can you let me know how I can force the session to logout after 30 minutes of inactivity?

share|improve this question
    
Will the user be promted for his credentials on logon? –  Grumbler85 Mar 17 '13 at 14:56
    
Yes. We do not want the auto login. –  user15652 Mar 17 '13 at 16:41
add comment

2 Answers 2

Try this in powershell:

$sts = Get-SPSecurityTokenServiceConfig
$sts.WindowsTokenLifetime= (New-Timespan -Minutes 30)
$sts.LogonTokenCacheExpirationWindow = (New-Timespan -Minutes 30)
$sts.update()
IISReset
share|improve this answer
    
Thanks for sending. I ran this and changed it to 1 minutes to quickly test but I am afraid it keeps the user logged in event after 10 minutes of inactivity. –  user15652 Mar 17 '13 at 16:41
    
Are you using ADFS? –  Amit Kumawat Mar 17 '13 at 16:48
    
did you test it from internet or in your organization network? –  Amit Kumawat Mar 17 '13 at 16:51
    
We are using Active Directory. It was tested from external. –  user15652 Mar 17 '13 at 17:49
    
Even though you were testing externally, was the site in the user's Trusted Sites or Local Intranet zones? –  Danny Jessee Mar 17 '13 at 23:06
show 1 more comment

From the server side, you cannot assure a user session is killed impermanently, when using NTLM or(kerberos). While you can kill cookies and the user's current session, from the web app perspective, the user's OS and web browser work against you. Depending on the browser and OS config, they users' passwords will be cached and automatically re-submitted as soon as your web server sends over the HTTP Authenticate header. If the machine is NOT domain joined, killing the browser window may kill the session. IF the machine is domain joined, the OS does the caching and cannot be defeated.

Your only option to stop the SSO from doing its job is to use forms based auth.

share|improve this answer
    
Killing the browser does kill the session so you are right on with that. The machines are not domain joined. We tried fba but we were having to add users twice for ntlm and fba accounts because fba logs in with upn and shows users request as upn instead of display name as it does when auth using ntlm so thinks like exchange and lync does seem to flow as well when logging in with ntlm. Thoughts? Anything we are missing? –  user15652 Mar 18 '13 at 3:02
    
Any ideas on this? Any assistance would be appreciated. –  user15652 Mar 19 '13 at 13:00
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.