Timeout settings

The session timeout in Astra Schedule is set as a default to twenty minutes. This is a standard setting for a web application. Maintaining a web session requires network and server resources and represents a potential security threat. This is why an inactive web session is usually timed out in about twenty minutes. It is common for organizations to have a policy regarding open session persistence, so if you are considering adjusting the standard timeout, please consult your organization’s technology policies to make sure you will be complying.

It is important to understand that a web session timeout can be set at multiple areas, and any of these settings can override others, depending on network and security configuration. Because the timeout can be set at multiple areas and may depend on network settings, it is difficult to provide a definitive description of how to permanently define how long it will take an Ad Astra session to close. Once a session has been closed, it is possible to reopen it by logging back into the session. Logging back in will take the user to the page that was active when the session timed out. Data entered after to the last Save action will not be saved if the application times out.

NOTE: These changes must be made after every upgrade. Also, for the forms authentication timeout, it defaults to sliding expiration.  When using forms authentication with slidingExpiration set to true (default), the cookie is updated only when more than half the timeout value has elapsed. As a result of this, you might be logged off sooner than you think.

(Consider this: You have set the timeout to 30 minutes. You logon on at 3:00 pm; a FormsAuthenticationTicket is set to expire at 3:30 pm. The expiration of this ticket will not be extended for another 30 minutes until you make a request after 3:15 pm. So, if you made your last request at 3:15 pm, the ticket will still expire at 3:30 pm as more than half the timeout value has not elapsed - giving you a 15 minute window before you get logged out. On the other hand, if you had made a request at 3:16 pm, the expiration of the ticket is extended to 3:46 p.m.)

Timeout Settings in Astra Schedule

The first place to start is to adjust the timeout settings that are definable within the application. This is done in the web.config file. The timeout is listed in minutes. The web.config file is typically found in the following path:

C:\Program Files\Ad Astra\7.X.X.XX\Instances\instancename\Schedule

You can open the web.config file in Notepad and edit the relevant section (use the Find option under the Edit menu). The section to change is:

<roleManager defaultProvider="AstraSqlRoleProvider" enabled="true" cacheRolesInCookie="true" cookieName=".ASPROLES" cookieTimeout="30" cookiePath="/" cookieRequireSSL="true" cookieSlidingExpiration="true" cookieProtection="All">

Also look for this line and change the timeout if desired.

<sessionState mode="InProc" timeout="20" />

IIS 6.0 Timeout Settings

It is also possible to set the session timeout through adjusting settings in IIS. The session timeout can be set at the Default Web Site or for any sites under the Default Web Site. The recommendation is to set them all the same.

To set a connection time-out value for a specific Web or FTP site (this sets a global service connection time-out value):

1.In IIS Manager, expand the local computer, expand the Web Sites or FTP Sites folder, right-click a Web or FTP site, and click Properties.

2.On the Web Site or FTP Site tab, in the Connection timeout box, type the maximum number of seconds that IIS should maintain an idle connection before resetting the connection.

3.For the WWW service, verify that the Enable HTTP Keep-Alives box is selected.

4.Click Apply, and then click OK.

It is also possible to set the specific web application configuration by doing the following:

1.In IIS Manager, expand the local computer, expand the Web Sites or FTP Sites folder, right-click a Web or FTP site, and click Properties.

2.On the Directory or Virtual Directory tab, click the Configuration button.

3.On the Options tab, make sure the Session timeout is set appropriately.

4.Click OK.

It is also possible to also update the ASP.NET Session Timeout Using IIS (not available on Windows Server 2003 64-bit) (again, the timeout is in minutes):

 
Go to the setting by: Open IIS | Properties on Web Site or Virtual Directory | ASP.NET tab | Edit Configuration... | Authentication tab | adjust value for Cookie Timeout

The session state should also be checked by:

Open IIS | Properties on Web Site or Virtual Directory | ASP.NET tab | Edit Configuration... | State Management tab | Adjust value for "Session Timeout (minutes):"

There are also settings affecting the timeout at the IIS application pool level. To update the IIS application pool settings:

1.Go to the properties page of the IIS application pool.

2.Performance tab - Idle Timeout

3.Shutdown worker process after being idle for (time in minutes) defaults to 60 minutes.
This should be at least as long as the session timeout.

Continuing the application pool timeout settings…

Recycling tab - Recycle worker process (in minutes) defaults to 1740 (29 hours). This is probably OK but could affect things depending on when the interval occurs. This can be modified to occur at a specified time.

Summary

Changing these settings should result in changes to the timeout period users experience when navigating in Astra Schedule. It is possible, however, that other network configurations will impact on the user’s actual timeout experience. There could be settings for the server hardware or through a security application that would override the timeouts set through the above configurations. It is important to coordinate the timeout settings in Astra Schedule with the network policies of your organization.