Session Cookies

[tnieman]

Is it possible to change the domain being used for cookies?

We are using a single sign on through a portal. If the window with OTRS is closed without logging out, the session persists. We would like to be able to delete the cookie from our portal.

[CSL]

I'm pretty sure the code will just take the configured domain for otrs and use that as the domain for the session cookie. I don't know how you'd change that, probably in the session or authentication perl modules.

One way to do this might be to have a very short session idle logout time, say 15 or 20 minutes, but this could cause issues with agents timing out while writing replies or conducting searches.

Without SSO, when users don't click the log-out button and just close the window the session persists as well, so you're not losing anything compared to the normal functionality of otrs. Greater discipline for them to click 'log out' is probably the way to go, rather than trying to come up with a technical solution. It shouldn't really be a problem unless users hot-desk or share computers, in which case you probably want them authenticating without SSO from those machines, and drum into them that they need to log out properly to cover themselves against others using their account.

[crythias]

I agree with CSL. SSO precludes logout. That's the point of SSO.