This article explains how to configure authentication token expiry notifications for Windows, macOS, and iOS Clients. Notifications give users time to re-authenticate before their access changes.
Understanding Token Expiry Notifications
Configure notifications for your account in Access > Client Access > End-User Notifications > Client Operation Notifications. About to expire controls the pre-expiry warning, and Expired controls the expired-token prompt. You can enable either, both, or neither.
The pre-expiry warning is sent once at the configured lead time, from 1 to 720 minutes before token expiry. The default is 60 minutes. A final reminder is sent five minutes before expiry. The warning time applies to the account and does not change token validity.
While the Cato authentication token is valid, the user has a High confidence level. When it expires, the user is disconnected or moves to a Low confidence level, according to the Client Connectivity Policy. Re-authentication restores the High confidence level. For more information, see Configuring the Client Connectivity Policy.
Best Practice: For Always-On users, allow secured Internet access at a Low confidence level to keep Internet traffic protected after token expiry. For more information, see Remote Internet Security with One-Time Authentication.
Configuring Notifications
You need permission to configure Client Access settings. Configure notifications on Client Access; the grouped End-User Notifications page provides read-only enable states and previews.
To define when users are prompted to re-authenticate:
From the navigation menu, click Access > User Authentication.
Open the Additional Settings tab
In Re-authentication prompt, enable Before token expires: Notify User and enter the warning time in minutes, from 1 to 720. The default is 60 minutes.
Save your changes.