I have been reading different document about LTPA timeout and authentication cache timeout but still not very clear.  Here I put some scenarios and please help me to understand it:

Based on the following setting:
LTPA timeout: 2 hours
Session timeout: 30min
authentication cache timeout: 10min

1) User logs in at 9:00am and did touch the screen since that:
    If user clicks a button on 9:31am,  will they get a new LTPA token (since session is timeout) ?
2) User logs in at 9:00am and keep using the apps until 10:55am.  If user clicks the apps again at 11:01am, what will happen ?  (I assume LTPA has timeout, but how about authentication cache ?  it is vaild bewtween 10:55am-11:05am ?)

Also,  I have did some reading and it said that authentication cache timeout has to be similar than LTPA timeout.     Can/should authentication cache timeout bigger than session timeout ? Or it doesn't matter ?

Sam

 

I do not think many people know this off hand apart from IBM. Unfortunately testing is the only way to be sure. This is the reality of these little nuggets. Try variants and record. Use the traingle of tweak, test, report/tune, tweak, test, tune/report etc.

I am personally interested in this issue as I am going to write some articles on the more finer points of LPTA and security settings thuis year.

Hi Sam

  Three months ago from the question, but is a good question
 
  Searching other security issues I found this gem
 
  Security Cache, LTPA Token, and Session Time Outs

  Hope this helps,


Regards,

old blog post - but still good:
www.devops-insight.com/2009/11/increase-...
Explains the correlation between ltpa timeout/cache and session timeout.