0

We got LDAP SSO working for our site. Employees go to the site everyday and everyday they do not have to input their credentials... until Monday. I believe this has to do with cookies maybe? I think if the employees have not logged in in a couple of days (weekend) then they have to log back in. Every Monday they have a http authentication dialogue box (LDAP Authentication from the /user/login/sso url). It saves their credentials (if they hit remember my password), but they don't like hitting the enter key.

My /admin/config/people/ldap/authentication settings look like this: enter image description here

I then found this post: Why is session.cookie_lifetime set to 23 days?, where they say that in drupal it might have a session.gc_maxlifetimesetting in settings.php that is set to 23 days, but that the session.cookie_lifetime is set to 2.3 days. And that if the user doesn't visit the page withing 2.3 days then they start a new session or something. Does this mean if I adjust the ini_set('session.cookie_lifetime', 200000); to like 4 days that the employees wont need to hit enter anymore?

Improve this question
3
  • What is your cookie lifetime on admin/settings/ldap/sso?
    – Neograph734
    Dec 26, 2015 at 23:52
  • Under /admin/config/people/ldap/authentication cookie lifetime is set to 10yrs. But the url you gave me doesn't seem to be a valid one.
    – Daedalus
    Dec 27, 2015 at 13:40
  • It was from the ldap sso module description page. But I suppose that's not it then...
    – Neograph734
    Dec 27, 2015 at 15:55

1 Answer 1

Reset to default
2

The answer here explains the difference between the cookie types and when they destroy the session: Why is session.cookie_lifetime set to 23 days?

To answer your question specifically:

If you extend the session.cookie_lifetime to be longer, the session will last longer and users will less frequently require to login. If the user opens the page within session.cookie_lifetime from the last visit, the session will be extended for another session.cookie_lifetime. This can be repeated several times, but never longer then session.gc_maxlifetime after which a user is always forced to log in again.

If you extend the session.cookie_lifetime to last for eg. 4 days (so it survives the weekend), users that always open the page on workdays will have to login once every 23 days (session.gc_maxlifetime). You can also extend this value to last as long as you want.

Please keep in mind that although hitting the enter might be annoying, if security is part of your job as well, it might not be a good idea to have sessions lasting for long periods of time. Have them survive the weekend by having them last a day longer will not cause much problems, but allowing them to extend for ever and ever (session.gc_maxlifetime) could introduce security vulnerabilities.

Improve this answer
2
  • Good to know! I had a feeling this was going to be the case. But your answer gives me the confidence in saying it is a done. I implemented it this morning. So I won't empirically know if it worked till 2.3 days away. I Made a 14 day session.cookie_lifetime and a 90 day session.gc_maxlifetime. In our environment users have to change AD passwords every 90 days, so I used AD duration credentials as the demarcation for the session.gc_maxlifetime value. Our site is an intranet behind the firewall so vulnerabilities isn't a huge concern.
    – Daedalus
    Dec 28, 2015 at 19:13
  • Good to know it was of value to you! :)
    – Neograph734
    Dec 28, 2015 at 19:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.