<div dir="ltr">A redirect to the login page from error page would be a more reasonable solution IMO.<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Jan 4, 2017 at 3:23 PM, Robert Story <span dir="ltr"><<a href="mailto:rstory@tislabs.com" target="_blank">rstory@tislabs.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On Wed, 4 Jan 2017 14:40:06 -0500 Ravi wrote:<br>
RN> With SSO the client sends the client secret to SSO which is stored in the<br>
RN> session. Now when the clients session expires all the information including<br>
RN> the client secret is lost when the session is purged by the application<br>
RN> server.<br>
<br>
Is the session expiration time configurable?<br>
<br>
RN> 1. login to webadmin<br>
RN> 2. Leave the session until session time out on engine and user is<br>
RN> redirected to login page (the client id and secret are sent)<br>
RN> 3. If user tries to login now everything will be fine but if user leaves<br>
RN> and the session expires the session is purged, client secret is lost<br>
RN> 4. User enters user name password on the screen after coming back. The<br>
RN> login form does not have a session associated with it so the client and<br>
RN> secret are not found and SSO needs to report that the session has expired<br>
RN> and redirect user to welcome page.<br>
<br>
So in step 4, can't it just start a new session instead of going to an<br>
expiration page? Or show the page for a few seconds and then start a new<br>
session?<br>
<br>
Or in step 2, set a refresh on the login page that still has a session so<br>
that when the session expires it will redirect to a login screen that will<br>
start a new session?<br>
<div class="HOEnZb"><div class="h5"><br>
<br>
<br>
Robert<br>
<br>
--<br>
Senior Software Engineer @ Parsons<br>
</div></div></blockquote></div><br></div>