SSO Session Management for WordPress

What is SSO Session Management?

SSO Session Management controls what happens to a user's login session after they sign in through Single Sign On. Once a user is authenticated, the site needs to decide how long to keep them logged in, what happens when they go idle, and whether different user roles should follow different session rules.

How does SSO Session Timeout work?

When a user logs in through SSO, the miniOrange SSO Session Management Addon starts a timer based on the duration set for that user's WordPress role. When the timer runs out, the session ends, and the user needs to sign in again through SSO. SSO session timeout can be set in seconds, minutes, hours, or days.

What is the difference between session timeout and idle timeout?

Session timeout ends a login after a fixed amount of time from when the user signed in, whether they are active or not. Idle session timeout only ends the session when the user stops interacting with the site for a period that the admin defines. An active user keeps their session going. An inactive user gets a warning message first, and if they do not respond, the session closes automatically.

Can I set a role-based session timeout for different users?

Yes. Role-based session timeout in the miniOrange Single Sign On Session Management Addon lets admins assign a different session duration to each WordPress user role. An administrator can get a 15-minute session, an editor can get eight hours, and a subscriber can get a full day. Each role follows its own rule automatically at login.

Can I enable Remember Me for SSO users?

Yes. Remember Me for SSO in the miniOrange Single Sign On (SSO) Session Management Addon keeps users signed in even after they close the browser. When they return to the site, they are already logged in without going through SSO again. Admins can turn this on for all SSO users, all non-SSO users, or limit it to specific roles like editors or authors only. When Remember Me is enabled, covered users get a fixed 14-day session. When it is turned off, the default or role-specific session time applies instead.

How does Persistent Login work with SSO?

Yes. Remember Me for SSO keeps selected users signed in after they close the browser. Admins can enable it for all SSO users, non-SSO users, or specific roles. Enabled users get a fixed 14-day session.