How can I troubleshoot a problem with external users' session lengths?

[Peter McGrath]

I manage an Atlassian cloud instance, with Atlassian Guard. 

I have external users using Jira heavily, using an external user authentication policy. Their sessions are set to expire after 7 days, but some users are reporting that they get logged out much more frequently. When I check the security audit log, though, I'm not seeing *any* events for these users. Are there other things I can check? 

[Renata_Getint]

Hi there!

Session length discrepancies can be frustrating to troubleshoot, but there are a few key areas to investigate beyond the audit logs. Here’s a step-by-step approach to help you pinpoint the root cause:

1. Check Authentication Policy Settings

Ensure the external user authentication policy is configured correctly, particularly for session lengths. If multiple policies or groups exist, confirm that the users experiencing issues are assigned the correct policy and not inheriting settings from a different one.

2. Inspect Browser and Device Behavior

• Cookies: Verify that users have cookies enabled, as these are essential for maintaining session persistence.
• Incognito/Private Mode: Check if users are accessing Jira in private browsing mode, which can prevent session data from being saved.
• Browser Extensions: Suggest disabling any ad blockers or privacy tools that might be interfering with session cookies.

3. Network and IP Address Changes

If your instance or the external authentication provider enforces IP-based session restrictions, frequent changes in IP (e.g., mobile networks or VPN usage) might force users to log in again.

4. Review External Authentication Logs

Since you’re using an external authentication policy, investigate its logs for any anomalies. Some providers enforce stricter session management or inactivity timeouts that may override your Atlassian Guard settings.

5. Time Zone and Clock Sync

Misaligned device clocks or time zones can cause premature session expiry in some systems. Encourage users to sync their device clocks to internet time.

6. Advanced Troubleshooting

• Use Developer Tools in a browser to monitor cookies and session headers. Look for irregularities or signs of session invalidation.
• Check OAuth2 tokens or SAML assertions if these are part of the authentication flow, as they might expire prematurely.

7. Atlassian Support

If the issue persists, Atlassian Support can perform a deeper analysis, potentially identifying back-end misconfigurations or conflicts between Atlassian Guard and your external authentication policy.

We hope this helps! If you’re managing a multi-tool environment and want to optimize cross-platform integrations or workflows, feel free to reach out to us at Getint. We're always happy to help you streamline your processes!

Best regards,
Renata