# Oidc session expires after 8 hours

**URL:** <https://discourse.openondemand.org/t/oidc-session-expires-after-8-hours/3906>\
**Category:** Get Help\
**Tags:** question\
**Created:** [December 3, 2024, 10:29am UTC](https://discourse.openondemand.org/t/oidc-session-expires-after-8-hours/3906 "2024-12-03T10:29:42Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![acknopper](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/acknopper/32/2271_2.png) [@acknopper](https://discourse.openondemand.org/u/acknopper)\
**Post date:** [December 3, 2024, 10:29am UTC](https://discourse.openondemand.org/t/oidc-session-expires-after-8-hours/3906/1 "2024-12-03T10:29:42Z")

</div>

Hi,

In our organisation we are using the LDAP Dex connector to authenticate to OOD. This is all working fine. A mod\_auth\_openidc\_session cookie is generated.  
However after 8 hours inside a running session, a 403 error occurs in the running app (Rstudio,Jupyterlab) because the session cookie expired.

According to the documentation in ood\_portal.yml we can set the following values where the 8 hours is default.  
oidc\_session\_inactivity\_timeout: 28800  
oidc\_session\_max\_duration: 28800

We want to have the session timeout at 12 hours (43200sec) because of long-runnig computations.  
If we change this to:  
oidc\_session\_inactivity\_timeout: 43200  
oidc\_session\_max\_duration: 43200

The session still expires after 8 hours. Inside the session cookie this value is Expires / Max-Age:“Session”. I thinks this means the value from oidc\_session\_max\_duration should apply here.  
Is there another setting which needs to be altered?  
Thanks in advance,  
Regards,  
Arthur

---

<div class="post-metadata">

**Author:** ![mjbludwig](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/mjbludwig/32/684_2.png) [@mjbludwig](https://discourse.openondemand.org/u/mjbludwig)\
**Post date:** [December 3, 2024, 6:13pm UTC](https://discourse.openondemand.org/t/oidc-session-expires-after-8-hours/3906/2 "2024-12-03T18:13:48Z")

</div>

John or Travis can probably confirm this but the Dex oidc bits are all set under the hood right? In the ondemand-portal.yml, you are only configuring the LDAP bits for Dex but the Apache → Dex OIDC parts are done automatically? i.e. at the moment there is no way to change those settings unless you go into the final apache config?

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [December 3, 2024, 6:23pm UTC](https://discourse.openondemand.org/t/oidc-session-expires-after-8-hours/3906/3 "2024-12-03T18:23:51Z")

</div>

You probably need to change the setting on the Dex side as well. From the read of the `mod_auth_oidc` docs on `OIDCSessionMaxDuration`, the ID token has an expiration time as well, so I’m guessing that’s what’s expiring though that appears to default to 24 hours in Dex so that may or may not be it.

> **[Tokens](https://dexidp.io/docs/configuration/tokens/)**
>
> Types of tokens and expiration settings

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [June 1, 2025, 6:24pm UTC](https://discourse.openondemand.org/t/oidc-session-expires-after-8-hours/3906/4 "2025-06-01T18:24:49Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.