Authentication time-out configuration

You configure authentication time-out on the Advanced tab of each Access Group form. For more information, see Learning about access groups.

Configure the authentication time-out according to your organization's security policies. Make sure that the authentication time-out is consistent with your organization’s policy so that you can set how long a user’s browser session can be idle before it requires reauthentication.

If your organization uses a custom authentication scheme such as single sign-on (SSO), the session time-out might be handled outside Pega Platform. In this case, compare the internal settings to the external settings. Determine the authentication time-out of your custom authentication scheme and verify that the Pega Platformauthentication time-out is consistent with the external time-outs.

If authentication is handled by an external system, you can turn off the Pega Platform authentication time-out feature by leaving the authentication time-out entry blank on the Advanced tab of the Access Group form.

You also can set a warning message that is displayed to the user whose session is about to expire. The user’s response to this message resets the user activity timer. The response to the warning renders the browser session no longer idle. To customize the message, update the localized value for the field value rule that has a field value equal to TimeoutWarning and a field name equal to pyMessageLabel.