Who is this article for?

  IT Administrators who want to control WebUI login behaviour for users of FBA.

  IT Administrator permissions are required to resolve the issue.

By default, the Web module keeps users logged in for 24 hours using a persistent authentication cookie (TngAuthentication). Administrators can change the configuration so that FBA users are always prompted to log in, forcing the cookie to behave as a session-only cookie. This article explains how the timeout works and how to modify the configuration safely.

Authentication Token Duration in the Web Module

Default Behaviour

When a user logs into the Web module, a 24-hour authentication window begins. During this period:

• The user does not need to re-enter their username and password.
• Closing and reopening the browser does not require reauthentication, provided the 24-hour window has not expired.
• This behaviour is controlled by the TngAuthentication cookie, which is created as a persistent cookie with a defined lifetime.

The cookie’s timeout period is configured in the Web module’s Web.Config file.

How the Timeout Is Configured

The authentication timeout is specified in the following section of the configuration file:

<Pentana.Tng.UI.Web.FBA>
    <add key="timeout" value="1440" />
</Pentana.Tng.UI.Web.FBA>

The value is specified in minutes.

1440 minutes = 24 hours.

Changing the Configuration to Require Login Every Time

If you want users to be prompted for their username and password every time they access the Web module, you can remove the persistent timeout by converting the authentication cookie into a session cookie.

Important:  Changing this configuration will cause the Web module service to restart.  Perform this change when no users are actively using the system.

Steps

1. Make a backup of the file WebUI\Web.Config
2. Open Web.Config in a text editor or App Manager.
3. Locate the section <Pentana.Tng.UI.Web.FBA>
4. Comment out the timeout line, changing:

<add key="timeout" value="1440" />

into:

<!-- <add key="timeout" value="1440" /> -->

5.   Save the file

Result of the Change

Once the timeout setting is commented out:

• The TngAuthentication cookie becomes a session cookie.
• Session cookies are removed automatically when the browser session ends.
• Users must re-enter their username and password each time they access the Web module.