We are trying to align our application's timeout behavior with Jira on the SAML flow. Our question is specifically about Jira with SAML SSO enabled: When Jira's local/application session times out, what is the expected behavior? * Does Jira initiate SAML Single Logout (SLO) immediately? * Or does Jira only clear its local session, and then redirect the user through the normal SAML login flow on the next protected request? * Is this behavior configurable? If yes, which settings control it? We are not asking about explicit user logout. We are asking specifically about session timeout while SAML SSO is enabled. Any official documentation, product behavior notes, or real-world experience would be very helpful.

nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Jira SAML flow: what happens after local session timeout?

Eka_lxwqi8

We are trying to align our application's timeout behavior with Jira on the SAML flow.

Our question is specifically about Jira with SAML SSO enabled:

When Jira's local/application session times out, what is the expected behavior?

Does Jira initiate SAML Single Logout (SLO) immediately?
Or does Jira only clear its local session, and then redirect the user through the normal SAML login flow on the next protected request?
Is this behavior configurable? If yes, which settings control it?

We are not asking about explicit user logout. We are asking specifically about session timeout while SAML SSO is enabled.

Any official documentation, product behavior notes, or real-world experience would be very helpful.

Accepted answers

Arkadiusz Wroblewski

Hello @Eka

for Jira Cloud, this behavior is controlled by the authentication policy, mainly the idle session duration and optionally session expiration.

When the Atlassian session times out, Atlassian simply ends its own session and requires the user to sign in again on the next request. If SAML SSO is enforced, that sign-in goes through the normal SAML login flow again.

SAML Single Logout is a separate feature and is triggered by an explicit logout action. Atlassian does not document idle session timeout as triggering SAML SLO.

So after a local session timeout, the user is just redirected back through the SAML login process, not logged out at the identity provider level.

KB Articles about this behavior:

https://support.atlassian.com/security-and-access-policies/docs/update-idle-session-duration/

https://support.atlassian.com/security-and-access-policies/docs/what-is-saml-single-logout/

https://support.atlassian.com/security-and-access-policies/docs/configure-saml-single-sign-on-with-an-identity-provider/

All comments

Arkadiusz Wroblewski

Hello @Eka

for Jira Cloud, this behavior is controlled by the authentication policy, mainly the idle session duration and optionally session expiration.

SAML Single Logout is a separate feature and is triggered by an explicit logout action. Atlassian does not document idle session timeout as triggering SAML SLO.

So after a local session timeout, the user is just redirected back through the SAML login process, not logged out at the identity provider level.

KB Articles about this behavior:

https://support.atlassian.com/security-and-access-policies/docs/update-idle-session-duration/

https://support.atlassian.com/security-and-access-policies/docs/what-is-saml-single-logout/

https://support.atlassian.com/security-and-access-policies/docs/configure-saml-single-sign-on-with-an-identity-provider/

Eka_lxwqi8

Hi @Arkadiusz Wroblewski, thanks, this is very helpful.

I have two follow-up questions:

Does your answer apply only to Jira Cloud, or also to Jira Data Center?
In your experience, is this behavior mainly determined by Jira itself, or can it vary depending on the IdP configuration?

I’m trying to understand whether this is a Jira-specific behavior or something that depends heavily on the IdP setup.

Arkadiusz Wroblewski

@Eka

For Jira Cloud, this is primarily Atlassian-controlled behavior: the local Atlassian session expires, and on the next protected request the user goes back through the normal SAML login flow. SAML SLO is documented for explicit logout, not for idle timeout.

For Jira Data Center the local Jira session timeout is Jira-side, but what happens next can depend on your Data Center SSO implementation and whether the IdP session is still alive. In practice, that usually means reauthentication rather than automatic SLO.

Here KB Articles about that on Data Center:

https://support.atlassian.com/jira/kb/how-to-change-the-default-session-timeout-to-avoid-user-logout-in-jira-data-center/

https://confluence.atlassian.com/crowd051/overview-of-sso-1295680996.html

https://confluence.atlassian.com/security/session-configuration-1409289248.html

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

jira

cloud

jira-cloud

sso

saml

timeout

session

slo