1196621 - add option for groups membership to force a maximum session time

Status: NEW

(bugzilla.mozilla.org :: General, enhancement, P2)

Description

[:glob ✱]

if you load bugzilla every day then your session will never timeout.  security groups will benefit from setting a maximum lifetime on sessions to force periodic reauthentication.

- add an optional "max_session_duration" int field to groups (days, 0 to disable)
- add "start_ts" (or similar) to logincookies
- set start_ts to the current timestamp when inserting into logincookies
- this setting applies to all group members, direct and inherited
- if a user has session limits applied add a row to edituser which shows the applicable group and duration
- create a nightly triggered script which:
  - find matching sessions given the lowest matching max_session_duration
  - delete logincookies rows
  - write an [audit] entry

Comment 1

[Dylan Hardison [:dylan] (he/him)]

Freeing this up as it is something that someone else could work on.