How to Configure the Session Timeout on SAS Viya 4

In a SAS^© Viya^™ environment, security and user experience partly depend on session management. By default, SAS^© Viya^™ web applications log out a user after a certain period of inactivity (usually 30 minutes).

This article guides you step-by-step to modify this interval via SAS^© Environment Manager, whether for all applications or for specific services.

Understanding How It Works

The timeout is based on user inactivity.

• Warning: A warning window appears 5 minutes before the actual disconnection.

• Choice: The user can choose to extend the session (which resets the counter) or to log out immediately.

⚠️ A Crucial Rule: SAS^© Logon Manager

Before modifying anything, it is imperative to understand the dependency on the SAS^© Logon Manager.

The timeout of the SAS^© Logon Manager service must always be greater than or equal to the longest timeout set for any other application.

• Example: If you set Application A to 45 minutes but leave the SAS^© Logon Manager at 30 minutes (default), Application A will still close after 30 minutes.

• Solution: To have a 45-minute session on an application, you must first set the SAS^© Logon Manager to at least 45 minutes.

Step-by-Step Configuration Guide

1. Access Definitions

Log in to SAS^© Environment Manager, then:

1. Use the dropdown menu to choose Definitions.

2. In the list of configuration definitions, select server.

3. At the top right, click on New Configuration.

2. Choose the Scope

In the window that opens, the Services field determines who the change applies to:

• For everyone (Global): Leave the default value.

• For specific applications: Click the selection icon, choose one or more SAS^© Viya^™ web applications, and then confirm.

3. Add Timeout Properties

You need to add a property by clicking Add property. The choice of property depends on the service type (Spring Boot or Go).

Option A: For Spring Boot Services (Most cases)

• Name: servlet.session.timeout

• Value: Must be expressed as a "Duration" with a unit (s for seconds, m for minutes, h for hours).

  • Example: 1800s or 30m.

  • Minimum required: 360s (6 minutes).

Option B: For Go Services

• Name: http.session.maxAge

• Value: Must be an integer representing seconds (without a unit letter).

  • Example: 1800

  • Minimum required: 360 (6 minutes).

4. Save

1. Click Save to close the property window.

2. Click Save again to close the server configuration window.

Applying the Changes

For the new timeouts to take effect, restarts are necessary:

1. Global Modification: You must restart all services.

2. Specific Modification: You must restart only the services you have modified.

3. Special Case (Go Services): If you have modified the property http.session.maxAge, the affected services restart automatically after saving.

Note: The changes will only apply to new sign-ins made after the restart.