Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As part of the security policy we are upgrading out systems to comply with, I need to set our Apache LDAP Auth to have a idle-timeout of 15 minutes.

I.e. If the user stops using the system for over 15 minutes, the next time they go to use it they will need to re-authenticate.

Is this even possible? If so, how can I achieve it?

My auth config in my .htaccess file looks like this:

AuthName "AD Authentication"
AuthType Basic
AuthBasicProvider ldap
AuthLDAPBindPassword "PASSWORD"
AuthzLDAPAuthoritative Off
require valid-user

Any ideas?

share|improve this question
To clarify, do you mean that the connection to the LDAP server needs to time out, or the user's session needs to time out? – Shane Madden May 4 '11 at 1:54
The users session - so if they idle for longer than 15 minutes, they need to re-authenticate. – Valorin May 4 '11 at 2:30

Unfortunately, basic authentication is not session-aware in any way. From the web server's perspective, they're actually forced to re-authenticate with every single request.

However, all browsers cache the credentials used for a basic auth connection, so that you don't need to re-enter credentials for every resource loaded from the server. The issue that this creates in your situation is that there's no way to 'expire' that data from the client browser; it keeps it as long as it wants.

To implement session timeouts, you may be stuck moving away from basic auth and toward a session-aware application.

share|improve this answer
Mmm... that will get annoying. Is there any way to tell the browser to forget the credentials and to re-authenticate? – Valorin May 4 '11 at 3:03
I don't believe so. – Shane Madden May 4 '11 at 3:11

A way to manually tell the browser to forget current credentials is to open the current address with another/invalid user.
share|improve this answer
This is not portable and might not work on all browsers. In fact there's no portable way to logout when basic or digest authentication is used. – FINESEC Nov 6 '12 at 17:47

Try instructions from this site:

share|improve this answer
Welcome to Server Fault. Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – Michael Hampton Jul 17 '13 at 7:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.