title: Spring Security with CAS - SessionTimeout configuration
body: <p>I have implemented Spring Security with CAS and was trying to configure session timeout. I see that setting values in <code>ticketExpirationPolicies.xml</code> will help with this. I have tried configuring values, but the session never get expired. I have tried setting session expiration in <code>web.xml</code> as well. Here is my <code>spring-application-context</code> configuration:</p>
  
  <pre><code>&lt;beans:beans xmlns="http://www.springframework.org/schema/security"
      xmlns:beans="http://www.springframework.org/schema/beans"
      xmlns:context="http://www.springframework.org/schema/context" 
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://www.springframework.org/schema/beans
  http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
  http://www.springframework.org/schema/security
  http://www.springframework.org/schema/security/spring-security-3.1.xsd
  http://www.springframework.org/schema/context 
  http://www.springframework.org/schema/context/spring-context-3.1.xsd"&gt;
      &lt;context:property-placeholder /&gt;
      &lt;http auto-config='true' entry-point-ref="casEntryPoint"&gt;
          &lt;intercept-url pattern="/**" access="ROLE_ADMIN" /&gt;
          &lt;custom-filter position="CAS_FILTER" ref="casFilter" /&gt;
          &lt;logout logout-success-url="/j_spring_cas_security_logout" /&gt;
          &lt;custom-filter ref="requestSingleLogoutFilter" before="LOGOUT_FILTER" /&gt;
          &lt;custom-filter ref="singleLogoutFilter" before="CAS_FILTER" /&gt;
      &lt;/http&gt;
      &lt;beans:bean id="singleLogoutFilter"
          class="org.jasig.cas.client.session.SingleSignOutFilter" /&gt;
      &lt;beans:bean id="requestSingleLogoutFilter"
          class="org.springframework.security.web.authentication.logout.LogoutFilter"&gt;
          &lt;beans:constructor-arg value="https://myipaddress:8443/cas/logout" /&gt;
          &lt;beans:constructor-arg&gt;
              &lt;beans:bean
                  class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" /&gt;
          &lt;/beans:constructor-arg&gt;
          &lt;beans:property name="filterProcessesUrl" value="/j_spring_cas_security_logout" /&gt;
      &lt;/beans:bean&gt;
      &lt;beans:bean id="casFilter"
          class="org.springframework.security.cas.web.CasAuthenticationFilter"&gt;
          &lt;beans:property name="authenticationManager" ref="authenticationManager" /&gt;
          &lt;beans:property name="authenticationSuccessHandler"&gt;
              &lt;beans:bean
                  class="org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler"&gt;
                  &lt;beans:property name="defaultTargetUrl" value="/" /&gt;
              &lt;/beans:bean&gt;
          &lt;/beans:property&gt;
      &lt;/beans:bean&gt;
      &lt;beans:bean id="casEntryPoint"
          class="org.springframework.security.cas.web.CasAuthenticationEntryPoint"&gt;
          &lt;beans:property name="loginUrl"
              value="https://myipaddress:8443/cas/login" /&gt;
          &lt;beans:property name="serviceProperties" ref="serviceProperties" /&gt;
      &lt;/beans:bean&gt;
      &lt;beans:bean id="serviceProperties"
          class="org.springframework.security.cas.ServiceProperties"&gt;
          &lt;beans:property name="service"
              value="https://myipaddress:8443/myApp/j_spring_cas_security_check" /&gt;
          &lt;beans:property name="sendRenew" value="false" /&gt;
      &lt;/beans:bean&gt;
      &lt;authentication-manager alias="authenticationManager"&gt;
          &lt;authentication-provider ref="casAuthenticationProvider" /&gt;
      &lt;/authentication-manager&gt;
      &lt;beans:bean id="casAuthenticationProvider"
          class="org.springframework.security.cas.authentication.CasAuthenticationProvider"&gt;
          &lt;beans:property name="userDetailsService" ref="userService" /&gt;
          &lt;beans:property name="serviceProperties" ref="serviceProperties" /&gt;
          &lt;beans:property name="ticketValidator"&gt;
              &lt;beans:bean
                  class="org.jasig.cas.client.validation.Cas20ServiceTicketValidator"&gt;
                  &lt;beans:constructor-arg index="0"
                      value="https://myipaddress:8443/cas" /&gt;
              &lt;/beans:bean&gt;
          &lt;/beans:property&gt;
          &lt;beans:property name="key"
              value="an_id_for_this_auth_provider_only" /&gt;
      &lt;/beans:bean&gt;
      &lt;user-service id="userService"&gt;
          &lt;user name="user1" password="user1" authorities="ROLE_ADMIN" /&gt;
      &lt;/user-service&gt;
  
  &lt;/beans:beans&gt;
  </code></pre>
  
  <p>I do have Single Signout configuration in web.xml:</p>
  
  <pre><code>&lt;listener&gt;
      &lt;listener-class&gt;
          org.jasig.cas.client.session.SingleSignOutHttpSessionListener
      &lt;/listener-class&gt;
    &lt;/listener&gt;
      &lt;filter&gt;
          &lt;filter-name&gt;characterEncodingFilter&lt;/filter-name&gt;
          &lt;filter-class&gt;
              org.springframework.web.filter.CharacterEncodingFilter
          &lt;/filter-class&gt;
          &lt;init-param&gt;
              &lt;param-name&gt;encoding&lt;/param-name&gt;
              &lt;param-value&gt;UTF-8&lt;/param-value&gt;
          &lt;/init-param&gt;
      &lt;/filter&gt;
      &lt;filter-mapping&gt;
          &lt;filter-name&gt;characterEncodingFilter&lt;/filter-name&gt;
              &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  </code></pre>