How to manage different webapp & directory service session times? And how to deny access to removed users?

user_1628284 0
Viewed 14

I am creating a webapp that uses passport.js to connect to Azure AD, and several other User Directory services. I am wanting to remain signed in for several days at a time, and not need to click sign in every 15 minutes.

Using azure as an example With this SSO verification: My site 'www.webapp.com' redirects the user to signs on at 'b2c.azure.com'. I get a callback containing the user from 'b2c.azure.com' . The user now has 1 session on 'b2c.azure.com' and another session on 'www.webapp.com'.

azure.com will be configured with it's own session timeout, say 30 minutes.

webapp.com can implement it's own session timeouts, say 2 days.

If 45 minutes after authenticating, the user is removed from azure.com They will remain active on 'www.webapp.com' for another 1 day, 23 hours and 15 minutes.

www.webapp.com could forward the user to the sign in on azure every 10 minutes, to see if the user is authenticated, but that means:

  1. The app is 'restricted' by azures session time, it can not be longer
  2. It is inefficient as has to regularly send the user to azure.com to re-sign in, sending them away from The app.
  3. There is a poor user experience of constantly signing in.

How do webapps manage to :

  1. Have longer session times than the directory service they support & so not require regular sign in
  2. Not provide service to users who have been removed from the directory service

p.s. I know in theory session time should be 15 minutes - 30 minutes for security reasons, but I don't want to disrupt the user experience to re-sign in every 15-30 minutes.

oauth-2.0 express session cookies web-applications
1 Answers

If you want the webapp.com session to depend on the Azure session, then you have two options:

  1. You can provide Azure with a front-channel logout URL. When a user logs out from Azure then you will receive a request to that endpoint so that your app can clear the user's session. I'm not sure, though, how it works with an expired session.

  2. You can make calls periodically to Azure's authorization endpoint with prompt=none. This feature allows you to check whether a user is still logged in in Azure. You can then prolong your session only when you get a token response from Azure. If the user is logged out in Azure you will get an OAuth error response. Then you can decide what to do in your app - whether to let the user stay signed in or to prompt them to log in.

Many apps don't tie sessions to an external provider. Usually, webapp.com would only use Azure to authenticate the user, and then manage the session itself, regardless of the session length in Azure.

user_17122940
Related