Teleport web idle timeout issue

[farru1998]

We have been facing a problem in our organisation that teleport keeps logging out the web UI before the idle timeout.

Problem:
I am using teleport v16.x which runs on Amazon EKS. I have multiple internal tools running like grafana, ArgoCD which are only accessed via teleport. Now what happens is when starting the day developer logins teleport and start using internal-tools but all of a sudden after some time like ~20min or sometimes ~1hr when I try to access the internal tools teleport redirects me to the login and it gets really frustrating for the developers to login teleport for around ~10 times within a single day even though the web_idle_timeout is set to 12h.

I'm attaching a screenshot of our helm values as well for the reference:

Would really appreciate if someone has faced this similar issue or have any idea of it, Thanks.

[webvictim]

See my explanation here of how bearer tokens work in the web UI: #30213 (reply in thread)

This likely explains why it seems that sessions are shorter than you're looking for.

Out of interest, can you share an example role that your developers use?

[farru1998]

@webvictim Hey thanks for your answer, was just wondering if this was a bug like it's actually impacting the user experience.

Here's the role:

kind: role
metadata:
  description: engineers role
  name: engineers
  revision: 00000000-0000-0000-0000-000000000000
spec:
  allow:
    app_labels:
      app:
      - watchman
      - codequality
      - argocd
    kubernetes_resources:
    - kind: pod
      name: '*'
      namespace: '*'
      verbs:
      - '*'
  deny: {}
  options:
    cert_format: standard
    create_db_user: false
    create_desktop_user: false
    create_host_user: false
    desktop_clipboard: true
    desktop_directory_sharing: true
    enhanced_recording:
    - command
    - network
    forward_agent: false
    idp:
      saml:
        enabled: true
    max_session_ttl: 30h0m0s
    pin_source_ip: false
    port_forwarding: true
    record_session:
      desktop: true
    ssh_file_copy: true
version: v4

[webvictim]

Thanks - just wanted to make sure that the max_session_ttl wasn't set to a low value.