Enforce session timeout when user is active for long period (e.g. 12 hours)

[michiel.jeuken]

To enforce a re-authentication for a user per tenant.

This is a company security requirement for systems working with Most Confidential data.

The requirements are session re-authentication in 12 hours or 15 minutes inactivity

The max period a user can stay active should be configurable or potential be specified as an assertion or time value in the SAML token (SSO) for Anaplan to act upon.

Currently Anaplan user can stay in the system for days as long as user stays active (e.g. using a robot)

[michiel.jeuken]

According to Rob Marshall (Anaplan):

two types of timeouts where the user will need to reauthenticate:

• After 30 minutes of inactivity
• We also have a “wellness timeout” which is at 12 hours.  Meaning, if a user is logged in and has been doing work consistently, they will be required to reauthenticate at the 12 hour mark.  We call it a “wellness” timeout, but it could also be referred to as a “get a life” timeout

This is not (yet) documented, assuming this is indeed the case -> wellness timeout is meeting our company MC control