title: Is it possible to set an ASP.NET Owin security cookie's ExpireTimeSpan on a per-user basis?
body: <p>We have an ASP.NET MVC 5 app using Owin cookie authentication. Currently, we set up cookie authentication as follows:</p>
  
  <pre><code>public partial class Startup
  {
      public void ConfigureAuth(IAppBuilder app)
      {
          var timeoutInMinutes = int.Parse(ConfigurationManager.AppSettings["cookie.timeout-minutes"]);
  
          app.UseCookieAuthentication(new CookieAuthenticationOptions
          {
              AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
              AuthenticationMode = AuthenticationMode.Active,
              LoginPath = new PathString("/"),
              ExpireTimeSpan = TimeSpan.FromMinutes(timeoutInMinutes),
              SlidingExpiration = true,
              LogoutPath = new PathString("/Sessions/Logout")
          });
      }
  }
  </code></pre>
  
  <p>We have a feature request to allow our application's admins to customize session timeouts within their organizations. However, the configuration code above executes at the MVC application level and our app is multi-tenant. Does anyone know of a way to set the ExpireTimeSpan of a user's session on a per-user basis, either during authentication or by overriding an Owin pipeline event somewhere?</p>
  
  <p>Thanks in advance!</p>