Authentication and Session Idle Timeout
1 vote
Hello.
We are using Entra ID authentication with DUO 2FA.
The goal that want to achieve, is to use our standard authentication method (Entra ID) with additional security. We need our most valued data to be the most secure. It's also part of our ISO 27001 certification that we achieve that.
The plan to add DUO was in thinking that we do not want to restrict Entra ID sessions to short session idle timeouts. But we need Devolutions Server to have something like 4 hours session idle timeout. We set that in the server, but it seems that's not the goal of that setting.
We would like to achieve that a user who is idle over 4 hours, gets his session disconnected by the server, and that he needs to login again. Entra ID will have his session open, so it will seamlessly go to the 2FA step with DUO.
This is not the case today, and we feel it's against our certification to have sessions that are kept alive over 60 hours.
Thank you and best regards.
Devolutions Server, RDM and GW admin.
Recommended Answer
Hello Marcel,
Good news on this one: the "On close" and "On idle" disconnection options for the Password Manager browser extension have been implemented in a recent version.
You can configure them here
Apologies for not coming back to update this topic once it shipped. Don't hesitate to let me know if the behavior matches what you were looking for.
Best regards,
François Dubois