why are users logged out after 2 days of not logging in We got LDAP SSO working for our site. Employees go to the site everyday and everyday they do not have to input their credentials... until Monday. I believe this has to do with cookies maybe? I think if the employees have not logged in in a couple of days (weekend) then they have to log back in. Every Monday they have a http authentication dialogue box (LDAP Authentication from the /user/login/sso url). It saves their credentials (if they hit remember my password), but they don't like hitting the enter key.

My /admin/config/people/ldap/authentication settings look like this: 


I then found this post: Why is session.cookie_lifetime set to 23 days?, where they say that in drupal it might have a session.gc_maxlifetimesetting in settings.php that is set to 23 days, but that the session.cookie_lifetime is set to 2.3 days. And that if the user doesn't visit the page withing 2.3 days then they start a new session or something. Does this mean if I adjust the ini_set('session.cookie_lifetime', 200000); to like 4 days that the employees wont need to hit enter anymore?
The answer here explains the difference between the cookie types and when they destroy the session: Why is session.cookie_lifetime set to 23 days?

To answer your question specifically:

If you extend the session.cookie_lifetime to be longer, the session will last longer and users will less frequently require to login. If the user opens the page within session.cookie_lifetime from the last visit, the session will be extended for another session.cookie_lifetime. This can be repeated several times, but never longer then session.gc_maxlifetime after which a user is always forced to log in again.

If you extend the session.cookie_lifetime to last for eg. 4 days (so it survives the weekend), users that always open the page on workdays will have to login once every 23 days (session.gc_maxlifetime). You can also extend this value to last as long as you want.

Please keep in mind that although hitting the enter might be annoying, if security is part of your job as well, it might not be a good idea to have sessions lasting for long periods of time. Have them survive the weekend by having them last a day longer will not cause much problems, but allowing them to extend for ever and ever (session.gc_maxlifetime) could introduce security vulnerabilities.