Skip to main content

Login when the network is unavailable

You can log in to an application with an authenticator even without a physical network connection. Logging in with a cached authenticator is similar to logging in with an authenticator when the network is available.

To configure login when the network is unavailable:

  1. Configure session caching with group policies or in the registry.
  2. Enable caching and configure the authenticator validity period in Management Console.
  3. Configure the session storage period in the cache.

Prerequisites​

Login when the network is unavailable is possible in the following cases:

  • Your account has been granted permission to cache authenticators.
  • Authenticators were cached at the first login to the application with an authenticator.
  • A login with a cached authenticator was performed while the network was available.

Configure session caching​

When there is no connection to Core Server, users can authenticate in ESSO Agent in the offline mode. For this, a session cached on the user computer is used.

To configure login with a cached session, use the Session public key settings policy in Group Policy Editor:

  1. Add the AxidianID.SessionPublicKey.admx policy file from the Axidian Access <version number>\Misc\ADMX Templates folder to the computer with Core Server.
  2. Open Group Policy Editor.
  3. Open Computer Configuration → Administrative Templates → Axidian ID → Cache server.
  4. Enable the Session public key settings policy.
  5. In the policy properties, in the Session public key field, enter the value of the public key generated during the Core Server installation. You can find the public key value in the SessionPublicKey.pub file or in the Core Server Web.config configuration file, in the sessionEncryptionSettings section, in the publicKey parameter.
  6. Go to Computer Configuration → Administrative Templates → Axidian ID → Client Connection.
  7. Enable the Axidian EA\ESSO server availability check policy.
  8. In the policy parameters, set the values for the Check result waiting timeout (ms) and Check result lifetime (ms) settings.

Enable caching and configure the authenticator validity period​

You can enable caching and set the validity period of cached authenticators in the application settings of a policy or a user in Management Console. If the validity periods are not specified, caching is valid indefinitely.

If the Number of days parameter is set for cached authenticators, their validity period is counted from the time of the last login through Enterprise SSO with the network available, using any authenticator except Windows Password.

For example, if the period is set to 10 days and the login to the application was performed at 10:00 on 12.04.2025, the cached authenticators are valid from 10:00 on 12.04.2025 until 10:00 on 22.04.2025.

If the validity period of cached authenticators has expired and Core Server is unavailable, the following message appears when you try to log in to the application: Login error. The user data caching period has expired.

Configure the session storage period in the cache​

For short-term connection losses to Core Server, you can configure the period during which the session can be reused.

During the specified period, the session is stored in the cache and can be reused when a new server connection is requested. The server availability check is not repeated; the cached check result is used instead.

After the storage period expires, the session is terminated. A new session is created at the next server connection request.

To configure the session storage period in the cache:

  1. Open Group Policy Editor.
  2. Open Computer Configuration → Administrative Templates → Axidian ID → Client Connection.
  3. Enable the Server connection settings policy.
  4. In the policy properties, set the required value for the Session object hold period (ms) parameter. The default value is 180,000 ms (3 minutes).