Session management

Session lifecycle

• Sessions remain active for 8 hours from login (the refresh token lifetime). Automation orchestrator persists session data in the PostgreSQL database.
• Access tokens expire every 15 minutes. The client automatically refreshes them using the ao_refresh_token HttpOnly cookie.
• The refresh token is not rotated. The same token remains valid for its full lifetime. The session has a fixed 8-hour boundary from login and cannot be extended by refreshing.
• Users can have multiple concurrent sessions (multiple browser tabs, multiple devices).
• Each session records the device, IP address, authentication method, and identity provider for audit and administrative visibility.

Session behavior during identity provider outages

Because automation orchestrator manages sessions independently, sessions provide resilience during temporary identity provider outages.

During an active session: Users can continue working for up to 8 hours. Access token refresh uses the internal PostgreSQL session store and does not contact the identity provider.

After a session expires: Users cannot log in again until the identity provider is restored. Local accounts, including the built-in administrator, can still log in because they use local authentication.

Single logout (RP-initiated logout)

By default, logging out of automation orchestrator revokes the local session but does not end the session at the identity provider. With Single logout enabled, automation orchestrator redirects the user to the identity provider's end-session endpoint after logout. This terminates the upstream session, providing that the identity provider supports RP-initiated logout.