Advanced form options enables you to configure the
following:
Under Cookie Settings, you can provide a name for the
cookie that ISA Server provides to the client after forms-based
authentication has succeeded. From the drop-down list, you can
select whether the cookies are persistent (continue to exist on the
client after the session ends) on all computers, only on private
computers, or never.
Under Client Security Settings, you can select:
Treat as maximum idle time, to set a time-out based on
the amount of time that the client is idle.
Treat as maximum session duration, to set a time-out
based on the session length. Then provide time-outs for public and
private computers, which will be used to establish the maximum idle
time or maximum session length.
Log off when the user leaves site if you want the user
to be automatically logged off when he navigates away from the site
to which he has logged on.
For more information about authentication in ISA Server, see
Authentication Concepts in ISA Server 2006 at the
Microsoft ISA Server TechCenter Web site(http://www.microsoft.com).
Important
When a session reaches the time-out threshold, clients are
required to log on to the session using their user
credentials.
When you configure a time-out for forms-based authentication,
we recommend that the time-out be shorter than that imposed by the
published server. If the published server times out before ISA
Server, the user may mistakenly think that the session ended. This
could allow attackers to use the session, which remains open until
actively closed by the user or timed out by ISA Server as
configured on the form setting.
Use persistent cookies to allow opening documents from
Microsoft Windows SharePoint Services without the need to
reauthenticate.
Note the following security issues related to persistent
cookies:
A malicious attacker who obtains a persistent cookie may be
able to perform a brute force attack to obtain user credentials
from the cookie.
On a public computer, if the user does not log off, the session
cookie can be used by the next user to access published sites. This
threat can be mitigated by not enabling persistent cookies for
public computers.
Get latest ISA Server content at ISA
Server Guidance.
Send
feedback about this page.