Jira SAML flow: what happens after local session timeout?

[Eka]

We are trying to align our application's timeout behavior with Jira on the SAML flow.

Our question is specifically about Jira with SAML SSO enabled:

When Jira's local/application session times out, what is the expected behavior?

1. Does Jira initiate SAML Single Logout (SLO) immediately?

2. Or does Jira only clear its local session, and then redirect the user through the normal SAML login flow on the next protected request?

3. Is this behavior configurable? If yes, which settings control it?

We are not asking about explicit user logout. We are asking specifically about session timeout while SAML SSO is enabled.

Any official documentation, product behavior notes, or real-world experience would be very helpful.

[Arkadiusz Wroblewski]

Hello @Eka 

for Jira Cloud, this behavior is controlled by the authentication policy, mainly the idle session duration and optionally session expiration.

When the Atlassian session times out, Atlassian simply ends its own session and requires the user to sign in again on the next request. If SAML SSO is enforced, that sign-in goes through the normal SAML login flow again.

SAML Single Logout is a separate feature and is triggered by an explicit logout action. Atlassian does not document idle session timeout as triggering SAML SLO.

So after a local session timeout, the user is just redirected back through the SAML login process, not logged out at the identity provider level.

KB Articles about this behavior:

https://support.atlassian.com/security-and-access-policies/docs/update-idle-session-duration/ 

https://support.atlassian.com/security-and-access-policies/docs/what-is-saml-single-logout/ 

https://support.atlassian.com/security-and-access-policies/docs/configure-saml-single-sign-on-with-an-identity-provider/ 

[Eka]

Hi @Arkadiusz Wroblewski, thanks, this is very helpful.

I have two follow-up questions:

1. Does your answer apply only to Jira Cloud, or also to Jira Data Center?

2. In your experience, is this behavior mainly determined by Jira itself, or can it vary depending on the IdP configuration?

I’m trying to understand whether this is a Jira-specific behavior or something that depends heavily on the IdP setup.

[Arkadiusz Wroblewski]

@Eka 

For Jira Cloud, this is primarily Atlassian-controlled behavior: the local Atlassian session expires, and on the next protected request the user goes back through the normal SAML login flow. SAML SLO is documented for explicit logout, not for idle timeout.

For Jira Data Center the local Jira session timeout is Jira-side, but what happens next can depend on your Data Center SSO implementation and whether the IdP session is still alive. In practice, that usually means reauthentication rather than automatic SLO.

Here KB Articles about that on Data Center:

https://support.atlassian.com/jira/kb/how-to-change-the-default-session-timeout-to-avoid-user-logout-in-jira-data-center/ 

https://confluence.atlassian.com/crowd051/overview-of-sso-1295680996.html 

https://confluence.atlassian.com/security/session-configuration-1409289248.html