
m1b9h (m1b9h) asked a question.
If time out session are set to 4 hours, when user have reach 4 hours does Okta automatically re-authenticate the user if they are active or does Okta prompt the user to re-authenticate in the middle of their activity? I would like to lower the session timeout time however i do not want to disrupt workers with constant re-authentication notification. How can I accomplish this task?

Hello @m1b9h (m1b9h) ,
Thanks for posting.
You can manage the session lifetime. The maximum time the session can be set is currently 90 days.
All information available here:
https://support.okta.com/help/s/article/Okta-Sign-on-policy-Factor-and-Session-Lifetime?language=en_US
Now, as you mentioned, if you reduce the session to less than 4 hours, every time the session expires, the users will need to re-authenticate, but Okta does not log you out of your applications even though you might be logged out of your Okta session.
Okta does not control application sessions. The Okta session and the application session are mutually exclusive.
Once Okta has authenticated a user into the application, Okta's part in the transaction is over, so there is no method by which Okta can control the session from our end.
If the application session expires, it will require the user to re-authenticate with Okta.
If there is already an active Okta session when the app session expires, then simply re-establish a connection to the app, either through the Okta dashboard (IdP initiated) or directly through the app's sign on page (SP initiated).
https://support.okta.com/help/s/article/Why-does-Okta-session-expire-but-some-of-the-apps-are-still-open?language=en_US
Let us know if this helps you.
Daniela Chavarria.
Okta Inc.