To clarify; there are a few settings on the WebUI vs the one I believe you already found.. as well since this is not in our official help in our Security Guide (https://help.prognosis.com/prognosis/116/security) though I know its been requested to be added a time or two. (FYI @Chris )
How can I set the maximum session time limit (not an idle timeout)?
The Prognosis WebUI will leave a user logged in, if their browser is left logged in, by default for up to 48 hours. To adjust this open the Web.Config modifying or adding the highlighted sections to the CookieName section. Though this is NOT a user inactivity timeout, but a maximum session length timeout. Prognosis does not provide at this time true inactivity timeout periods; a work around for lack of user inactivity timers is reducing the user session timeout and / or using Application Pool Recycling.
<sessionState cookieName="Prognosis" mode="InProc" timeout="120"/>
Note: The timeout parameters are in minutes.
How can I set the maximum time to complete the login form?
The Prognosis WebUI uses the default .NET application timer to complete a login form, which is 20 minutes. To reduce this modify the following in the web.config.
....
<authentication mode="Forms">
<forms loginUrl="~/Login" timeout="15" cookieless="UseCookies" requireSSL="true" slidingExpiration="false" />
</authentication>
<pages enableSessionState="false">
How can I set a Prognosis User Inactivity Timeout?
The Prognosis WebUI (nor the desktop client) have a user inactivity timeout.
The setting available in the IIS 8.5 forward Application Pool Settings does not invoke a idle timeout because Prognosis on the display intervals refresh will generate the activity that resets this timer. All Prognosis screens in the View Systems mode and the Admin screen have such a refresh interval.
So setting the setting the PrognosisAppPool Idle Time-out(minutes) setting will not have the desired result from our testing.
How can I can I force a reset / disconnect of all sessions at a particular interval or time?
Application Pool Recycling:
Prognosis can be configured to terminate all WebUI connections on a set interval no matter how long the session is active (1 second to 5 hours) by performing the following. Generally this should not be done for most customer and more than every 8 hours to allow staff to login and stay logged in over the course of the day unless there is a specific requirement to do so which does not align with most uses cases of Prognosis.
This can be done via the PrognosisApplication Pool within Microsoft IIS:
Most of our IRGUI.ini settings are not documented in Public Facing help but I have gone through and documented most of them and can confirm @SCOTT_BALDWIN statement that there is no inactivity timer in there.
Though in terms of applicability and what you are trying to accomplish, and being you mentioned Audit, this question has come up many times before and I've researched it extensively and if this is in terms of PCI DSS 's "12.3.8 Automatic disconnect of sessions for remote-access technologies after a specific period of inactivity"....
We are not a Payments Application under the definition of PCI (see Help section on PCI Implications) and the way we deploy Prognosis with the tiered architecture and Route-To statements exclude us from the PCI in-scope area except for the administrative users in addition to we do not actually process / are exposed to PCI data outside of the CDE.
The IRTSVCOL.ini does have a "TRAWLER-MAX-IDLE-TIME-IN-MINUTES = 5" set so if we do not see activity from the Payments switch for 5 minutes.. we do disconnect the transaction feed to Prognosis (but Prognosis continues to run).
