website/docs: update docs about "stay logged in" option (#10832)
* reformatted and tweaked wording * fixed change to anchor * again with broken anchor * aligned code example --------- Co-authored-by: Tana M Berry <tana@goauthentik.com>
This commit is contained in:
@ -6,75 +6,79 @@ This stage attaches a currently pending user to the current session.
|
|||||||
|
|
||||||
It can be used after `user_write` during an enrollment flow, or after a `password` stage during an authentication flow.
|
It can be used after `user_write` during an enrollment flow, or after a `password` stage during an authentication flow.
|
||||||
|
|
||||||
## Session duration
|
## User login stage configuration options
|
||||||
|
|
||||||
By default, the authentik session expires when you close your browser (_seconds=0_).
|
When creating or editing this stage in the UI of the Admin interface, you can set the following configuration options.
|
||||||
|
|
||||||
:::warning
|
**Name**: enter a descriptive name for the stage.
|
||||||
Different browsers handle session cookies differently, and might not remove them even when the browser is closed. See [here](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#expiresdate) for more info.
|
|
||||||
:::
|
|
||||||
|
|
||||||
You can set the session to expire after any duration using the syntax of `hours=1,minutes=2,seconds=3`. The following keys are allowed:
|
**Stage-specific settings**
|
||||||
|
|
||||||
- Microseconds
|
- **Session duration**: By default, the authentik session expires when you close your browser (_seconds=0_).
|
||||||
- Milliseconds
|
|
||||||
- Seconds
|
|
||||||
- Minutes
|
|
||||||
- Hours
|
|
||||||
- Days
|
|
||||||
- Weeks
|
|
||||||
|
|
||||||
All values accept floating-point values.
|
:::warning
|
||||||
|
Different browsers handle session cookies differently, and might not remove them even when the browser is closed. See [here](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#expiresdate) for more info.
|
||||||
|
:::
|
||||||
|
|
||||||
## Stay signed in offset
|
You can set the session to expire after any duration using the syntax of `hours=1,minutes=2,seconds=3`. The following keys are allowed:
|
||||||
|
|
||||||
When this is set to a higher value than the default _seconds=0_, a prompt is shown, allowing the users to choose if their session should be extended or not. The same syntax as for _Session duration_ applies.
|
- Microseconds
|
||||||
|
- Milliseconds
|
||||||
|
- Seconds
|
||||||
|
- Minutes
|
||||||
|
- Hours
|
||||||
|
- Days
|
||||||
|
- Weeks
|
||||||
|
|
||||||

|
All values accept floating-point values.
|
||||||
|
|
||||||
## Network binding/GeoIP binding
|
- **Stay signed in offset**: When this is set to a higher value than the default _seconds=0_, the user logging in is shown a prompt, allowing the user to choose if their session should be extended or not. The same syntax as for _Session duration_ applies.
|
||||||
|
|
||||||
When configured, all sessions authenticated by this stage will be bound to the selected network/GeoIP criteria.
|

|
||||||
|
|
||||||
Sessions which break this binding will be terminated on use. The created [`logout`](../../../events/index.md#logout) event will contain additional data related to what caused the binding to be broken:
|
- **Network binding and GeoIP binding**
|
||||||
|
|
||||||
```json
|
When configured, all sessions authenticated by this stage will be bound to the selected network and/or GeoIP criteria.
|
||||||
{
|
|
||||||
"asn": {
|
Sessions that break this binding will be terminated on use. The created [`logout`](../../../events/index.md#logout) event will contain additional data related to what caused the binding to be broken:
|
||||||
"asn": 6805,
|
|
||||||
"as_org": "Telefonica Germany",
|
```json
|
||||||
"network": "5.4.0.0/14"
|
{
|
||||||
},
|
"asn": {
|
||||||
"geo": {
|
|
||||||
"lat": 51.2993,
|
|
||||||
"city": "",
|
|
||||||
"long": 9.491,
|
|
||||||
"country": "DE",
|
|
||||||
"continent": "EU"
|
|
||||||
},
|
|
||||||
"binding": {
|
|
||||||
"reason": "network.missing",
|
|
||||||
"new_value": {
|
|
||||||
"asn": 6805,
|
"asn": 6805,
|
||||||
"as_org": "Telefonica Germany",
|
"as_org": "Telefonica Germany",
|
||||||
"network": "5.4.0.0/14"
|
"network": "5.4.0.0/14"
|
||||||
},
|
},
|
||||||
"previous_value": {}
|
"geo": {
|
||||||
},
|
"lat": 51.2993,
|
||||||
"ip": {
|
"city": "",
|
||||||
"previous": "1.2.3.4",
|
"long": 9.491,
|
||||||
"new": "5.6.7.8"
|
"country": "DE",
|
||||||
},
|
"continent": "EU"
|
||||||
"http_request": {
|
},
|
||||||
"args": {},
|
"binding": {
|
||||||
"path": "/if/admin/",
|
"reason": "network.missing",
|
||||||
"method": "GET",
|
"new_value": {
|
||||||
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
|
"asn": 6805,
|
||||||
},
|
"as_org": "Telefonica Germany",
|
||||||
"logout_reason": "Session binding broken"
|
"network": "5.4.0.0/14"
|
||||||
}
|
},
|
||||||
```
|
"previous_value": {}
|
||||||
|
},
|
||||||
|
"ip": {
|
||||||
|
"previous": "1.2.3.4",
|
||||||
|
"new": "5.6.7.8"
|
||||||
|
},
|
||||||
|
"http_request": {
|
||||||
|
"args": {},
|
||||||
|
"path": "/if/admin/",
|
||||||
|
"method": "GET",
|
||||||
|
"user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
|
||||||
|
},
|
||||||
|
"logout_reason": "Session binding broken"
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
## Terminate other sessions
|
- **Terminate other sessions**
|
||||||
|
|
||||||
When enabled, previous sessions of the user logging in will be revoked. This has no affect on OAuth refresh tokens.
|
When enabled, previous sessions of the user logging in will be revoked. This has no affect on OAuth refresh tokens.
|
||||||
|
|||||||
@ -114,7 +114,7 @@ slug: /releases/2024.2
|
|||||||
|
|
||||||
Sessions for any users can now be bound to a specific geolocation (Continent, Country, City) or network (Autonomous System, subnet, IP address). If the session is accessed from a location/network that is different than that from which it was initially created, the session will be terminated.
|
Sessions for any users can now be bound to a specific geolocation (Continent, Country, City) or network (Autonomous System, subnet, IP address). If the session is accessed from a location/network that is different than that from which it was initially created, the session will be terminated.
|
||||||
|
|
||||||
Configuration steps are available [here](../../flow/stages/user_login/index.md#network-bindinggeoip-binding).
|
Configuration steps are available [here](../../flow/stages/user_login/index.md#user-login-stage-configuration-options).
|
||||||
|
|
||||||
- **S3 file storage**
|
- **S3 file storage**
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user