We’re experiencing frustrating SSO session timeouts in our Real Estate Management module on ics-2023-1. Users are being forced to re-authenticate every 15-20 minutes, which is severely disrupting their workflow when managing property portfolios and lease agreements.
I’ve checked the SSO session timeout settings in our identity provider configuration, and they’re set to 8 hours. The module settings in CloudSuite also appear to have reasonable timeout values. However, the actual behavior doesn’t match these configurations.
Has anyone else encountered this discrepancy between configured SSO session timeouts and actual session behavior? I’m particularly interested in understanding if there are hidden module-level settings that might be overriding the provider config, or if there’s a specific real estate management setting we’re missing.
Let me provide a comprehensive solution addressing all three critical areas you need to configure:
SSO Session Timeout Configuration:
The 15-20 minute timeout you’re experiencing is likely due to misaligned settings across multiple layers. Here’s the proper hierarchy: Your IdP assertion lifetime takes precedence, followed by CloudSuite tenant session timeout, then module-specific overrides.
Provider Configuration:
In your SAML IdP settings, verify these parameters:
SAML Assertion Lifetime: Set to 240 minutes (4 hours) - this is your actual session duration
Session Not On Or After: Should match or exceed assertion lifetime
Refresh Token Expiry: Set to 480 minutes (8 hours) for seamless token refresh
For ics-2023-1, navigate to Admin Console > Security Configuration > SAML Settings and ensure ‘Allow Session Extension’ is enabled. This permits CloudSuite to request new assertions before the current one expires.
Module Settings for Real Estate Management:
Access Module Configuration > Real Estate Management > Security Policies:
Set ‘Module Session Timeout’ to 240 minutes (matching SAML assertion)
Configure ‘Idle Timeout’ to 45 minutes (balances security with usability)
Enable ‘Warn Before Timeout’ - users get 5-minute warning to extend session
Set ‘Session Extension Limit’ to 2 extensions (total 12 hours max)
Critical step: In the Real Estate module settings, look for ‘Compliance Mode’ - if this is set to ‘High Security’, it enforces the 20-minute timeout regardless of other settings. Change this to ‘Standard’ unless regulatory requirements mandate otherwise.
After making these changes, clear your SSO token cache and test with a fresh login. The session should now persist for 4 hours of active use with automatic extension capability. This configuration properly addresses SSO timeout, provider config alignment, and module-specific settings while maintaining appropriate security for property management data.
If issues persist, enable SSO debug logging (Admin > Diagnostics > SSO Trace) and capture a full authentication flow to identify where the timeout is actually being triggered.
This draft is based on general Infor CloudSuite knowledge. It has not been verified against your specific version and environment. Practitioners: verify the steps and share your experience below.
I’ve seen similar issues with SSO timeouts not matching configuration. First thing to check: are you looking at both the IdP session timeout AND the CloudSuite application session timeout? They work in tandem, and the shorter value typically wins. Also verify your SAML assertion lifetime settings - if those are set to 20 minutes, that could explain the behavior you’re seeing.
Check your tenant-level session settings in CloudSuite admin console. Navigate to Security Settings > Session Management and look for ‘Module Override Timeout’ - this can supersede your IdP configuration. Real Estate Management module sometimes has its own session policies due to compliance requirements around property data access. You might need to explicitly extend the module timeout separately from your global SSO settings.
Thanks for the suggestions. I found the Module Override Timeout setting, and it was indeed set to 20 minutes for the real estate module. However, when I tried to change it to match our 8-hour IdP timeout, the system warned me about potential security implications. What’s a reasonable balance here?
The security warning is standard for financial and property management modules. Industry practice for real estate systems typically ranges from 2-4 hours for active sessions with idle timeout around 30-60 minutes. You don’t want to match your full 8-hour IdP timeout because property transactions involve sensitive financial data. Consider implementing a tiered approach: set your module timeout to 4 hours with a 45-minute idle timeout, and enable remember-me functionality for convenience.
Also worth checking if you have any proxy or load balancer session timeout settings that might be interfering. We had a similar issue where our F5 load balancer had a 15-minute session persistence timeout that was essentially breaking SSO sessions before they naturally expired. The application and IdP were configured correctly, but the infrastructure layer was the culprit.