4

Our SharePoint 2013 site will not log users out unless the browser is completely closed. We are using NTLM authentication but the site is hosted, so it is external accessible. We are afraid users will leave the browser open and their session/login will remain active indefinitely if the browser is not closed.

Can you let me know how I can force the session to logout after 30 minutes of inactivity?

Improve this question
2
  • Will the user be promted for his credentials on logon?
    – TGlatzer
    Commented Mar 17, 2013 at 14:56
  • Yes. We do not want the auto login.
    – user15652
    Commented Mar 17, 2013 at 16:41

2 Answers 2

Reset to default
1

Try this in powershell:

$sts = Get-SPSecurityTokenServiceConfig
$sts.WindowsTokenLifetime= (New-Timespan -Minutes 30)
$sts.LogonTokenCacheExpirationWindow = (New-Timespan -Minutes 30)
$sts.update()
IISReset
Improve this answer
6
  • Thanks for sending. I ran this and changed it to 1 minutes to quickly test but I am afraid it keeps the user logged in event after 10 minutes of inactivity.
    – user15652
    Commented Mar 17, 2013 at 16:41
  • Are you using ADFS?
    – Amit Kumawat
    Commented Mar 17, 2013 at 16:48
  • did you test it from internet or in your organization network?
    – Amit Kumawat
    Commented Mar 17, 2013 at 16:51
  • We are using Active Directory. It was tested from external.
    – user15652
    Commented Mar 17, 2013 at 17:49
  • Even though you were testing externally, was the site in the user's Trusted Sites or Local Intranet zones?
    – Danny Jessee
    Commented Mar 17, 2013 at 23:06
1

From the server side, you cannot assure a user session is killed impermanently, when using NTLM or(kerberos). While you can kill cookies and the user's current session, from the web app perspective, the user's OS and web browser work against you. Depending on the browser and OS config, they users' passwords will be cached and automatically re-submitted as soon as your web server sends over the HTTP Authenticate header. If the machine is NOT domain joined, killing the browser window may kill the session. IF the machine is domain joined, the OS does the caching and cannot be defeated.

Your only option to stop the SSO from doing its job is to use forms based auth.

Improve this answer
2
  • Killing the browser does kill the session so you are right on with that. The machines are not domain joined. We tried fba but we were having to add users twice for ntlm and fba accounts because fba logs in with upn and shows users request as upn instead of display name as it does when auth using ntlm so thinks like exchange and lync does seem to flow as well when logging in with ntlm. Thoughts? Anything we are missing?
    – user15652
    Commented Mar 18, 2013 at 3:02
  • Any ideas on this? Any assistance would be appreciated.
    – user15652
    Commented Mar 19, 2013 at 13:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.