About michiel.jeuken

michiel.jeuken

According to Rob Marshall (Anaplan): two types of timeouts where the user will need to reauthenticate: After 30 minutes of inactivity We also have a “wellness timeout” which is at 12 hours. Meaning, if a user is logged in and has been doing work consistently, they will be required to reauthenticate at the 12 hour mark. We call it a “wellness” timeout, but it could also be referred to as a “get a life” timeout This is not (yet) documented, assuming this is indeed the case -> wellness timeout is meeting our company MC control

michiel.jeuken · ‎10-18-2019

For authentication assurance level 3 (AAL3), the following controls apply which require a tenant an/or model specific session Time out setting: Reauthentication: 12 hours or 15 minutes inactivity; SHALL use both authentication factors

michiel.jeuken · ‎10-17-2019

To enforce a re-authentication for a user per tenant. This is a company security requirement for systems working with Most Confidential data. The requirements are session re-authentication in 12 hours or 15 minutes inactivity The max period a user can stay active should be configurable or potential be specified as an assertion or time value in the SAML token (SSO) for Anaplan to act upon. Currently Anaplan user can stay in the system for days as long as user stays active (e.g. using a robot)

About michiel.jeuken

Re: Enforce session timeout when user is active f...

Re: Ability for customers to set time frame for wh...

Enforce session timeout when user is active for l...

Ability for customers to set time frame for when s...