Docs: Sessions and Tokens

Wed, 29 Jul 2026 00:00:00 +0000

Signing in to Stroom creates a session, and Stroom issues tokens that are used to prove who a user is, both to Stroom itself and between the nodes of a cluster. This page describes how sessions and tokens are ended, both by users for themselves and by administrators.

Ending Your Own Sessions

Any user can end their own sessions other than the one they are currently using, by selecting

from the main menu.

This is useful after signing in from a machine that is no longer under their control. It applies across every browser and device, and across every node in the cluster.

Completing a password reset also ends all of that user’s sessions, including the one being used at the time. See Signing In.

The User Access Screen

A user holding the Manage Users or Administrator Application permission Application permission This is a permission that is not specific to a single document. It applies to all documents or is not related to documents in any way.Click to see more details... can see and end the access held by other users by selecting

from the main menu.

The screen lists users along with how many sessions and tokens each currently holds, and shows the sessions held for the selected user across every node in the cluster.

Two actions are available.

End this user’s sessions and revoke their tokens does exactly that, across the whole cluster rather than just the node serving the request. It does not withdraw their access: the account is untouched and they can sign in again.
Open this user opens the selected user, where they can be disabled. This is offered alongside revocation because the two are easily confused and do quite different things, as described below.

Revoking, Disabling, and the Difference between Them

Three actions are easy to confuse, and each does something different. To stop someone using Stroom completely and immediately, you need the last two together.

Action	Ends sessions and tokens	Prevents signing in again
End sessions and revoke tokens, on the User Access screen	Yes	No
Disable the Stroom User User Refers to a Stroom User that is linked to either an Account in Stroom’s internal Identity Provider or a user account in an external Identity Provider. A Stroom User is primarily concerned with authorisation (i.e. application/document permissions and group memberships) rather than authentication, though disabling one also refuses that person at authentication and ends any access they currently hold.Click to see more details..., on the Users screen	Yes	Yes
Disable the account, on the Manage Accounts screen	No	Yes

Ending sessions and revoking tokens does both of those things and no more. It deliberately leaves the account alone, so the password still works and the user can sign in again. Every token revoked this way is dead permanently, but their access as a whole is not withdrawn. It forces re-authentication rather than shutting anybody out, which makes it the right action when you want to be certain that whoever is currently signed in has to prove who they are again.

Disabling the Stroom User User Refers to a Stroom User that is linked to either an Account in Stroom’s internal Identity Provider or a user account in an external Identity Provider. A Stroom User is primarily concerned with authorisation (i.e. application/document permissions and group memberships) rather than authentication, though disabling one also refuses that person at authentication and ends any access they currently hold.Click to see more details... does everything the above does, and additionally refuses them at authentication, whether they are signing in interactively or presenting a token. This is the action to take when someone must be stopped, and is what the Open this user button on the User Access screen is for.

Disabling the account, which only applies when Stroom is its own Identity Provider (IDP) Identity Provider (IDP) An Identity Provider is a system or service that can authenticate a user and assert their identity. Identity providers can support single sign on (SSO), which allows the user to sign in once to the Identity Provider so they are then authenticated to all systems using that IDP.Click to see more details..., stops them authenticating at all. It does not disturb a session that is already running. See User Accounts.

Warning

This matters most when Stroom is configured to use an external Identity Provider (IDP) Identity Provider (IDP) An Identity Provider is a system or service that can authenticate a user and assert their identity. Identity providers can support single sign on (SSO), which allows the user to sign in once to the Identity Provider so they are then authenticated to all systems using that IDP.Click to see more details…. Revoking a user’s sessions and tokens does not touch the session they hold with that provider, so their next request is likely to sign them straight back in automatically, without their even being asked for a password.

To prevent access when using an external Identity Provider (IDP) Identity Provider (IDP) An Identity Provider is a system or service that can authenticate a user and assert their identity. Identity providers can support single sign on (SSO), which allows the user to sign in once to the Identity Provider so they are then authenticated to all systems using that IDP.Click to see more details…, disable the account at that provider, in Stroom, or both.

Token Lifetimes

These are the defaults, and are configurable under stroom.security.identity.token..

Token	Property	Default
Access token	`accessTokenExpiration`	60 minutes
Refresh token	`refreshTokenExpiration`	30 days
Password reset link	`emailResetTokenExpiration`	10 minutes
API key	`defaultApiKeyExpiration`	365 days

Refresh tokens can be used only once, and each use issues a replacement. If a refresh token is presented a second time, which suggests it has been copied, Stroom withdraws that token and every token descended from it.

Stroom – session