How To Manage User Sessions
ServiceNow allows ServiceNow admins the ability to automatically control the maximum amount of time users can be logged in for.
This is really helpful if you’d like to make users re-authenticate after a set period of time. This will help to maintain the security of the system.
The answer lies in a system property in the system. That system property is: glide.ui.session_timeout.
When you navigate to the system property, you’ll clearly see the definition field with the following value, providing all the information you need to either keep it out of box, or update it.
Description: Sets the session timeout, in minutes. Values exceeding 1440 minutes will be treated as one day.
There are also a couple of other system properties that are related to the session timeout property that you as a ServiceNow Admin, should be aware of that are covered here.
How To Update The System Property
Role: admin
System Property: glide.ui.session_timeout
Note: This system property should be in your ServiceNow instance, by default. But if it’s not – then you can go ahead and add it to the system. Sometimes, depending on how your implementation went and how long you’ve had your ServiceNow environment, system properties aren’t always there. In these scenarios, it’s completely fine to create them manually.
Navigate directly to the System Properties table in your ServiceNow instance.
You can get there by typing the table name, followed by .list, in the application navigator – as shown below:
Once you hit enter, you’ll be shown the list view of every system property in your system.
When you’re seeing all of the system properties, navigate to the correct record: glide.ui.session_timeout
Once you’ve found it, enter the record:
So the out of box value here is 90 minutes. If you’re unaware of what you should do here, just leave it out of box.
Controlling the session timeout value simpy requires users to re-log back into your ServiceNow instance after X amount of time. It’s primarily a security measure to ensure we are having the right users in the system that we trust.
What Are The Other Related System Properties To Session Timeouts?
There is a Remember Me button on the /login.do or navpage.do page.
If this button is marked true for the current user, then they are not impacted by any of the system properties surrounding timeouts for user sessions. This is important for admins to understand.
System Property: glide.ui.auto_req.extend.session
There is another related property to also be aware of, that’s the Session Extension system property (glide.ui.auto_req.extend.session).
When glide.ui.auto_req.extend.session is marked true, ServiceNow will take the value that the user has set for their homepage refresh time, and automatically extends the users session by that amount. So it takes the system timeout value, and then adds that to their homepage refresh value. If no homepage refresh value exists here, then the normal system timeout values will be used. This only applies on a computer – and does not apply to either a mobile device or an iPad.
Guest sessions are also related here. As users that are not technically authenticated to a ServiceNow environment, can access ServiceNow pages. This is most commonly applied to the Knowledge Base, but can be seen in other areas where ServiceNow allows guest sessions.
System Property: glide.unauthorized.session_timeout
This system property controls the session timeout value (in minutes) for unathenticated users.
If you don’t allow guest sessions in your instance, then you don’t have to worry about this property.
[…] How To Manage Session Timeout System Properties in ServiceNow […]