Session Limit for different users

We're doing something like this in our environment. The way I've gotten it to work is by using an iRule that gets called from the during the APM flow (added in the policy editor (VPE)). The iRule you're looking for might look something like this:

when ACCESS_POLICY_AGENT_EVENT {
    if { [ACCESS::policy agent_id] eq "setSessionTimeoutAgent" } {
        if { [ACCESS::session data get session.ad.last.attr.memberOf] contains "AD_GROUP_NAME" } {
            ACCESS::session data set session.inactivity_timeout 10800
        }
    }
}

I'm not sure how to check for an OTP user since I've yet to do that, but this should help get you started...

Hmm, ok so I thought I knew what I was doing. Not so. I created the irule, however, I'm not sure that the box is actually referencing it when I apply it in the vpe. EG: "Custom IRule Event Agent" ID.

I am quite new with APM, so sorry if what I'm asking is obvious.

I was messing with this for too long. It turns out there is a variable that can be created . It's in the help!

Yes, what I'm talking about is the Variable Assign. You can use Predefined Session Variables, Customer Variables, Configuration Variables.

In my case, I used a Predefined Session Variable called "Maximum Session Timeout" and could set the session variable to 10800.

Super easy, works like a charm.

All I was interested in from the start was having a different max session timeout for otp users versus our mission critical users. So, yes, the session.inactivity_timeout is not what I was looking for, though there is a variable for that in the setting I referred to above.