Troubleshooting Authentication

Use this topic to resolve common authentication and session issues on the Delinea Platform.

Issue: Users are logged out sooner than expected

Users report that their Delinea Platform session ends after 15–30 minutes, even though the identity policy sets a longer timeout.

Cause: Session lifetime is governed by three independent layers. A logout earlier than the configured timeout means one of these layers ended the session.

Layer What it controls and where to check
Identity policy Idle and session-length logout. Check User Idle Timeout, Session Length, and Keep me logged in under Browser Session Parameters.
Browser Logout after a backgrounded or slept tab. Check Microsoft Edge Sleeping Tabs or Google Chrome Memory Saver settings on the user's browser.
Federation and Active Directory Session revocation for federated users, independent of the timers. Check Connector reachability to a domain controller.

Solution: Work through the following checks in order.

Step 1: Confirm which identity policy applies

A logout after about 15 minutes usually means the default User Idle Timeout is in effect, not your configured policy. Identity policies are evaluated in stack-ranked order. A higher-ranked policy, or a different group assignment, can take precedence over the policy you configured.

  1. Open the affected user on the Users page.
  2. Click the Identity policy summary tab to see the policies that apply to the user.
  3. On the Identity Policies page, verify the intended policy's group assignment and its position in the policy stack.

Step 2: Rule out browser tab sleep

The idle timer resets on mouse or keyboard activity in any open Delinea Platform tab. If the browser puts the Delinea Platform tab to sleep, the tab stops refreshing its session token. The user is then logged out during the next refresh token validation cycle.

  1. Ask the user to keep the Delinea Platform tab visible, not minimized or backgrounded.
  2. Confirm whether the early logout still occurs.
  3. If the logout stops, add the tenant URL to the browser's sleep exclusion list. See Troubleshooting PRA Inactivity Timeouts for the Microsoft Edge procedure.

Private and Incognito windows do not disable Microsoft Edge Sleeping Tabs or Google Chrome Memory Saver. Reproducing the logout in a private window rules out extensions and cached cookies, but not tab sleep.

Step 3: For Federated users, check connector reachability

The Delinea Platform periodically validates active federated sessions against Active Directory through the AD Connector. If the Connector cannot reach a domain controller, the session is revoked regardless of the configured timers.

  1. Confirm whether the affected users are federated.
  2. Check Connector health and domain controller reachability. See Federated Users Experience Unexpected Session Logouts.

Step 4: Inspect network traffic for 401 errors

If the cause is still unclear, open the browser's developer tools and review the network traffic when the logout occurs.

  • 401 Unauthorized: The session token is expired or no longer valid. Any 401 response from the API triggers an automatic logout.
  • 403 Forbidden: The Delinea Platform recognizes the user, but the user is not authorized to access the resource. A 403 indicates a permissions issue, not a session issue.

A 401 response followed by a redirect to the sign-in page confirms the session ended. Use the previous steps to identify which layer ended it.

Related Topics