Session and Links Expiry Time
The Session and Links Expiry Time settings allow administrators to manage user session durations, control concurrent logins, and define expiration rules for system-generated links and tokens. These configurations help ensure security, optimise system performance, and maintain compliance by limiting the validity of user sessions and access credentials.
Configure the 'Session and Links Expiry Time' parameters in Global Settings
Click the 'Configurations' option from the navigation panel.
Click the 'Global Settings' option.
Select the 'Session and Links Expiry Time' option from the drop-down.
Configure these settings as required and click the "Save" button. See the table below for field descriptions.
Global Settings - Session and Links Expiry Time
Fields
Description
User session timeout (mins)
Specify the number of minutes of user's inactivity (i.e. 5), after which your SigningHub Desktop Web should display the session expiry warning (pop up) to the logged in user. The user will be given the options whether to "Stay Connected" or "Log out". However, if the user does not respond to it for the next 15 seconds, the user will be automatically logged out from the SigningHub web.
Concurrent session limit
Specify the number of session (s) of Concurrent Sessions Limit (i.e 5) after which your SigningHub Desktop Web will not allow any further logins. By default the limit is set to 5 logins which is also the maximum limit for the concurrent sessions.
Registration & invitation link expiry (mins)
Specify the number of minutes (i.e. 60) after which the registration and invitation links of a user should expire. The users will have to respond to these links within the allowed time to complete their registration.
Forgot password & delete account link expiry (mins)
Specify the number of minutes (i.e. 60) after which the exclusive "Forgot Password" and "Delete Account" links of a user should expire. The user will have to respond to these links within the allowed time to change their password or permanently delete their account.
Access token expiry time (secs)
Specify the number of seconds (i.e. 8000) after which the access token of a user should expire. An Access Token is a credential that can be used by a client to access an API. It is an opaque string that identifies a user, app, or a page and can be used by the app to make graph API calls.
Refresh token expiry time (days)
Specify the number of days (i.e. 2) after which the refresh token of a user should expire. A Refresh Token is a special kind of token that is used to obtain a renewed access token for a user without needing them to re-authenticate. SigningHub keeps requesting new access tokens until the refresh token expires.
Trusted device token expiry time (days)
Specify the number of days (i.e. 30) after which the trusted device token should expire. This token allows users to skip additional authentication steps when accessing SigningHub from a previously trusted device. Once expired, the user will be prompted to re-authenticate the device.
SCIM token expiry time (days)
Specify the number of days (i.e. 7) after which the SCIM (System for Cross-domain Identity Management) token should expire. This token is used for secure communication between SigningHub and external identity providers for automated user provisioning and management. The default value for this field is 365 days.
For concurrent sessions, the following system behaviour is followed:
In case of a session timeout, the session will be deleted instantly.
In case of a session kill, the session will be retained in the database but shall be deleted once the core thread runs, and a period of 4 hours has passed since its retention.
The link expiration time will be displayed in DD:HH:MM format, for the following emails:
"Reset Account Password" email
"Account Activation" email
However, for the existing enterprise users, this change will take place once the admin resets to default the 'Email Content' in "Enterprise Settings". To reset the 'Email Content' to default:
Log in to SigningHub Web with your enterprise admin credentials.
Click "Configuration" in the left menu and click on "Notifications" in Settings options in Enterprise Configurations.
Expand the "Email Content" tab.
Click on any email type and click the "Edit" button in the right panel.
Click the "Reset to Default" button to discard your customisations and bring the content of all the emails back to their default.
Last updated