FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Basic

How is an AGS session kept; what does the Sessions screen show? ​

Short answer

An AGS session is the record opened on TR7 when the client enters the access flow of an AGS-enabled vService; the browser carries only the session cookie, while the authentication state and the user information coming from the provider are kept on TR7. The session is in the Unauthenticated state until the verification is completed and in the Authenticated state after the user logs in; its duration and its binding to the client are determined by the Session Protection Policy selected for the vService. The Sessions tab of the vService lists the sessions alive at that moment (the session ID, the state, the last activity, the expiry time, the client's IP and browser, the user information) and allows the selected sessions to be ended with Revoke Session(s).

How Does It Work? ​

  1. When the client enters the access flow, the session is opened and a session cookie is given to the browser; the session is in the Unauthenticated state.
  2. When the user passes the provider and MFA steps in the flow, the session becomes Authenticated; information such as the username, the e-mail and the groups is written to the session with the attribute mapping and can be used with Smart Variables.
  3. On every subsequent request the session is inspected: if a binding type is selected in the policy, the client's binding value (the IP address, the IP address together with the User-Agent, or the Composite components) is compared with the value recorded at login, and a request that does not match is not considered authenticated; as activity is seen, the session duration is extended by Session Idle Timeout, and Session Absolute Timeout cannot be exceeded.
  4. When the session expires or is deleted with Revoke Session(s), the user's next request enters the access flow again.

If no Session Protection Policy is selected for the vService, the idle duration of the session is 1 hour and the session is not bound to the client.

The Sessions Tab in TR7 ​

The tab is reached via the Left Monitor Panel → AGS-Enabled vServices → vService → Sessions path.

ItemWhat it shows / what it does
Default columnsSession ID, Auth State, Last Activity, Expires At, IP, User-agent, User ID, Username, Email; Provider, TTL and the other user fields are added from the column selector
Auth StateAll Sessions (default), Authenticated, Unauthenticated
LimitThe number of the newest sessions to be read from each device; default 500
RefreshThe list is not refreshed by itself; the current state is fetched with this button
Revoke Session(s)Permanently deletes the selected sessions after confirmation; the operation is written to the User Logs screen

The domain name for which the session cookie is valid and the cookie name prefix are determined in the Flowchart's General Settings window with the Cookie Domain and Cookie Name Prefix fields.

Common Misconceptions ​

  • "The Sessions screen also shows past logins." The screen shows only the sessions alive at that moment; past login events are examined on the Audit Logs tab (What are AGS Audit Logs; which events are recorded?).
  • "Revoke also closes the user's session at the identity provider." The operation deletes only the AGS session on TR7; a user whose session stays open at the external provider (e.g. OpenID Connect) can be authenticated without being asked for a password when entering the flow again.
  • "The AGS session and the application's session are the same." The application on the Backend Service keeps its own session separately (What is a session; in which senses is it used in TR7?).
  • "Each row is a user." Each row is a session; the sessions the same user opens from different browsers appear on separate rows, and the sessions of clients that have not logged in are also listed as Unauthenticated.

How it is done in the documentation

Related questions