I tried configuring automatic logout on inactivity using the preview feature "Authentication Profiles API" in Amazon Connect Customer
This page has been translated by machine translation. View original
Introduction
Amazon Connect customers can use the Authentication Profiles API to configure automatic logout when users have been inactive for a certain period of time.
At the time of writing, this feature is in preview release. To use it, you need to request access from a Connect Customer Solutions Architect, Technical Account Manager, or AWS Support.
This time, after requesting activation from AWS Support, I tried the following from AWS CloudShell.
- Check the current settings
- Enable automatic logout by setting the inactivity time to 15 minutes
- Verify behavior with users who logged in before and after the configuration change
- Revert to the settings before verification
In this verification, users who logged in after the configuration change were automatically logged out after 15 minutes of inactivity. On the other hand, users who were already logged in before the configuration change remained logged in even after 15 minutes had passed since the configuration change.
Prerequisites
The verification environment for this time is as follows.
- AWS Account ID:
111111111111 - Region:
ap-northeast-1 - Operating environment: AWS CloudShell
- Authentication profile:
Default Authentication Profile
The instance ID and authentication profile ID in the article are examples. If you actually try this, please replace them with values from your own environment.
Requesting Activation from AWS Support
I executed the following command in an environment where the Authentication Profiles API was not enabled.
aws connect list-authentication-profiles \
--instance-id aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee \
--region ap-northeast-1 \
--no-cli-pager
The following error occurred.
An error occurred (InvalidRequestException) when calling the
ListAuthenticationProfiles operation:
Account 111111111111 is not allowed to use this feature.
Please contact customer support.
For this reason, I submitted a request from AWS Support Center to enable the Authentication Profiles API in ap-northeast-1.
Confirming Activation and Current Values
After activation, run the list-authentication-profiles command again.
aws connect list-authentication-profiles \
--instance-id aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee \
--region ap-northeast-1 \
--query 'AuthenticationProfileSummaryList[].{Id:Id,Name:Name,IsDefault:IsDefault}' \
--output table \
--no-cli-pager
The execution result is as follows.
---------------------------------------------------------------------------------------
| ListAuthenticationProfiles |
+--------------------------------------+---------------------------------+------------+
| Id | Name | IsDefault |
+--------------------------------------+---------------------------------+------------+
| 11111111-2222-3333-4444-555555555555 | Default Authentication Profile | True |
+--------------------------------------+---------------------------------+------------+
The InvalidRequestException that occurred before activation did not appear, and the Default Authentication Profile was successfully retrieved.
Next, specify the authentication profile ID to check the current settings.
aws connect describe-authentication-profile \
--instance-id aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee \
--authentication-profile-id 11111111-2222-3333-4444-555555555555 \
--region ap-northeast-1 \
--query 'AuthenticationProfile.{MaxSessionDuration:MaxSessionDuration,SessionInactivityDuration:SessionInactivityDuration,SessionInactivityHandlingEnabled:SessionInactivityHandlingEnabled}' \
--output table \
--no-cli-pager
The execution result is as follows.
-----------------------------------------------------------------------------------------
| DescribeAuthenticationProfile |
+--------------------+-----------------------------+------------------------------------+
| MaxSessionDuration | SessionInactivityDuration | SessionInactivityHandlingEnabled |
+--------------------+-----------------------------+------------------------------------+
| 720 | 60 | False |
+--------------------+-----------------------------+------------------------------------+
The settings before verification were as follows.
| Setting Item | Setting Value | Meaning | Configurable Range |
|---|---|---|---|
MaxSessionDuration |
720 minutes | The maximum session duration before the user is required to log in again | Cannot be changed. Fixed at 720 minutes (12 hours) |
SessionInactivityDuration |
60 minutes | The time from when the user becomes inactive until automatic logout | 15–720 minutes |
SessionInactivityHandlingEnabled |
false |
Whether to enable automatic logout when inactive | true or false |
SessionInactivityDuration is 60 minutes, but since SessionInactivityHandlingEnabled is false, automatic logout on inactivity was disabled before verification.
Enabling Automatic Logout on Inactivity
This time, I will change the inactivity time to 15 minutes, which is the minimum configurable value.
aws connect update-authentication-profile \
--instance-id aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee \
--authentication-profile-id 11111111-2222-3333-4444-555555555555 \
--session-inactivity-handling-enabled \
--session-inactivity-duration 15 \
--region ap-northeast-1 \
--no-cli-pager
There is no output on success, so use describe-authentication-profile to confirm the changed values.
aws connect describe-authentication-profile \
--instance-id aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee \
--authentication-profile-id 11111111-2222-3333-4444-555555555555 \
--region ap-northeast-1 \
--query 'AuthenticationProfile.{MaxSessionDuration:MaxSessionDuration,SessionInactivityDuration:SessionInactivityDuration,SessionInactivityHandlingEnabled:SessionInactivityHandlingEnabled}' \
--output table \
--no-cli-pager
The execution result is as follows.
-----------------------------------------------------------------------------------------
| DescribeAuthenticationProfile |
+--------------------+-----------------------------+------------------------------------+
| MaxSessionDuration | SessionInactivityDuration | SessionInactivityHandlingEnabled |
+--------------------+-----------------------------+------------------------------------+
| 720 | 15 | True |
+--------------------+-----------------------------+------------------------------------+
The inactivity time has been set to 15 minutes and automatic logout has been enabled.
The Default Authentication Profile changed this time applies to all users in the instance, unless overridden by another authentication profile.
Behavior Verification
I waited for more than 15 minutes without operating the mouse or keyboard and without any voice contacts in the following two patterns.
| Session Start Point | Result |
|---|---|
| Logged in before configuration change | Remained logged in |
| Logged in after configuration change | Automatic logout |
For users who logged in after the configuration change, a session expiration warning screen was displayed, followed by automatic logout.
Session expiration warning screen displayed to users who logged in after the configuration change
In this verification, automatic logout occurred for sessions started after the configuration change. On the other hand, the new settings were not immediately reflected in sessions that existed before the configuration change.
The public documentation does not provide details on when new settings are applied to sessions that existed before the configuration change. Therefore, when enabling this in a production environment, it would be advisable to notify users in advance and consider requiring them to log in again.
Reverting to Original Settings
Before verification, the inactivity time was 60 minutes and automatic logout was disabled.
Use the following command to revert to the original settings.
aws connect update-authentication-profile \
--instance-id aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee \
--authentication-profile-id 11111111-2222-3333-4444-555555555555 \
--session-inactivity-duration 60 \
--no-session-inactivity-handling-enabled \
--region ap-northeast-1 \
--no-cli-pager
After the configuration, check the current values.
aws connect describe-authentication-profile \
--instance-id aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee \
--authentication-profile-id 11111111-2222-3333-4444-555555555555 \
--region ap-northeast-1 \
--query 'AuthenticationProfile.{MaxSessionDuration:MaxSessionDuration,SessionInactivityDuration:SessionInactivityDuration,SessionInactivityHandlingEnabled:SessionInactivityHandlingEnabled}' \
--output table \
--no-cli-pager
The execution result is as follows.
-----------------------------------------------------------------------------------------
| DescribeAuthenticationProfile |
+--------------------+-----------------------------+------------------------------------+
| MaxSessionDuration | SessionInactivityDuration | SessionInactivityHandlingEnabled |
+--------------------+-----------------------------+------------------------------------+
| 720 | 60 | False |
+--------------------+-----------------------------+------------------------------------+
Since SessionInactivityHandlingEnabled has been returned to false, automatic logout on inactivity is disabled.
Supplementary Notes
At the time of writing, the only configurable target is the Default Authentication Profile provided for each instance. Since this setting applies to all users in the instance, it is not possible to target only specific users for verification.
When making changes in a production environment, it would be advisable to test on a verification instance or during a time period with minimal business impact.
If you are integrating with an existing web application using AmazonConnectStreams or AmazonConnectSDK, you need to implement activity handling on the application side before enabling automatic logout on inactivity.
Also, automatic logout on inactivity is not supported in the Virtual Desktop Infrastructure (VDI) isolated Contact Control Panel (CCP) model. If you are using something other than the standard Agent Workspace, please check your usage configuration in advance.
Summary
I was able to enable the preview feature Authentication Profiles API and configure automatic logout on inactivity for Amazon Connect customers.
In this verification, I confirmed automatic logout after 15 minutes for users who logged in after the configuration change. On the other hand, users who were already logged in before the configuration change remained logged in.
Since changes to the Default Authentication Profile affect users in the instance, it would be advisable to notify users in advance and verify behavior in a production environment.
