Policy Server Guides › Policy Design Guide › Implementing Policy-based Security › Strategies for Managing Security and Users › How the End-user Experience Is Managed › How Sessions Are Managed

How Sessions Are Managed

By managing sessions, you control how long an authenticated and authorized user can access the resource. You can control sessions by:

• Specifying the amount of time a user can remain idle, without interacting with the resource.

  Idle timeouts protect against unauthorized use of the resource by limiting the amount of time the session remains active if it is not being used. The idle timeout is particularly useful in cases where users leave their computer without logging out of their session. When the idle timeout limit is reached, the session automatically ends.

• Specifying the maximum amount of time a user can access a resource before they must re-authenticate.

  Maximum timeouts protect against unauthorized use of a resource by forcing an authenticated user to re-authenticate after a specified time. This safeguard ensures that if an authenticated user leaves the computer without logging out and someone else uses the open session, the session will end after a specified amount of time, and the user must re-authenticate to continue using the resource.

• Revoking a user’s access to a resource at any time.

  In addition to managing how long a session can remain active, you can also end a session immediately if you suspect the integrity of a resource has been compromised. Once a user session has been revoked, the user is disabled in the user directory until you have re-enabled the user with the Policy Server User Interface.

  For more information about managing sessions, see the SiteMinder Policy Server Management Guide.

• Enabling persistent sessions.

  You can also implement persistent sessions to provide Windows security context functionality and support for Federated Web Services.

More information:

How Privileges Are Established

How Content Is Personalized

How Persistent Sessions for User Security Contexts Are Maintained