Limit OTP vpn session

Hi,

 

Very new to F5 APM. and I don't know tcl, so I'm definitely looking for some expert advice here.

 

I am aware that we have a fixed maximum session time for vpn access policy.

 

I want an iRule for OTP users that will limit the session to two hours from when the token is generated, and then end their session.

 

caveat: If the user waits 1 hour to use the token, their session doesn't BEGIN when they login at that point, and give them 2 hours, but rather that they only have 1 hour remaining when they login.

 

Thank you in advance!