3

We have a new Sharepoint Server which uses Sharepoint Server 2010. It runs on Windows Server 2008.

We are using it as a Webserver and need to deploy a timeout for all users who access it for security purposes.

Currently it is configured to use Windows Based Authentication on port 80 although we have tried to change this and set up a Form Based Authentication (FBA) site on different port and set the timeout settings for this also but it does not work.

We have tried using the timeout features of IIS and Sharepoint itself with a FBA setup and the user account still does not time out as required.

We are using FBA with LDAP environments.

Any help would be appreciated.

Note: We have visited the following link for solution but we don't know if we have a April 2011 Update installed on our sharepoint server as we are on SP2010 Build Version 14.0.6137.5002

http://jasear.wordpress.com/2011/01/10/sharepoint-2010-set-session-timout-on-a-fba-enabled-site/

  • You can kill the session with FBA using Request.Cookes.Remove() I believe will sign you out completely. Have you tried using this to close the session of the user or setting the expiry on the cookie? – Hugh Wood Jun 12 '13 at 15:27
  • Where do i need to use Request.Cookes.Remove() method? We want session to be timed out if user is in active for 20 mins. – user1263981 Jun 12 '13 at 16:08
2

Have you tried with:

$sts = Get-SPSecurityTokenServiceConfig
$sts.FormsTokenLifeTime = (New-TimeSpan -minutes 30)
$sts.Update()
Get-SPSecurityTokenServiceConfig

That will set up your web.config with the proper values, because if you are using WIF, you should be looking at "CookieHandlerElement", not "forms" tag.

1

The point you need to set is the timeout value for your cookie in your forms configuration of your web config. Once expired the user will be logged out. Timeout is in minutes.

Hope this is enough for what you are looking for.

<authentication mode="Forms" >
  <forms loginUrl="~/Account/SignIn" timeout="1200" cookieless="UseCookies" />
</authentication>
  • I have tried your solution but no success – user1263981 Jun 12 '13 at 17:39
  • Does session timeout work on local domain? I am testing FBA website on our local domain. – user1263981 Jun 13 '13 at 9:56
  • We are using FBA with LDAP environments. – user1263981 Jun 13 '13 at 10:10
  • Is timeout = 20 mins or 1200 sec? as per msdn i think it should be set to mins msdn.microsoft.com/en-us/library/1d3t3c61(v=vs.71).aspx – user1263981 Jun 13 '13 at 12:10
  • You are right sorry I presumed seconds "Specifies the amount of time, in integer minutes" – Hugh Wood Jun 13 '13 at 13:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.