Sessions
The Sessions section lists all SSO sessions — both active and recently expired.
IdP sessions vs. OAuth sessions
Autentico maintains two layers of sessions:
-
IdP sessions (SSO browser sessions) represent a single browser or device login. One IdP session is created when a user authenticates, and a cookie ties that browser to the session. This is what enables single sign-on — the user logs in once and subsequent authorization requests from any client are served without re-prompting for credentials.
-
OAuth sessions (per-client token sessions) are created each time the user authorizes a specific client during an IdP session. Each OAuth session holds the access and refresh tokens issued for that client. A single IdP session can have many child OAuth sessions — one for each client the user authorized during that browser session.
The Sessions page in the Admin UI shows IdP sessions. Each entry represents one browser/device login for a user.
Session list
Each session entry shows:
| Field | Description |
|---|---|
| User | Username of the authenticated user |
| IP address | Client IP at login time |
| User agent | Browser/client user-agent string |
| Status | active, expired, or deactivated |
| Created at | When the session was established |
| Last activity | Most recent authorization request on this session |
Session expiry is not stored as a database column. It is computed from created_at + sso_session_max_age at validation time. See SSO Sessions for details on session lifetime settings.
Revoking sessions
Click a session and select Revoke to immediately deactivate it. Revoking an IdP session triggers a cascade revocation: the IdP session is deactivated along with all of its child OAuth sessions and their associated access and refresh tokens, all in a single transaction. The user's next request from that browser will require re-authentication.
This is useful for:
- Forcing a specific user to re-authenticate (e.g. after a password reset)
- Responding to a suspected account compromise
- Clearing stale sessions for a user
Cleanup
Expired and deactivated sessions are removed automatically by the background cleanup job. See Architecture > Design Decisions for details on the cleanup interval.