Fine-grained user authentication and activity tracking

1. A method of controlling access to a protected resource, the method comprising:

at an access manager server having a hardware processor and a memory storing global session settings applicable to all resources and sessions in a first domain:

receiving, a time value for server-side sessions maintained by the processor using a session lifecycle, the session lifecycle comprising creation, updates, idleness, and expiration, the server-side sessions configured with access to the protected resource when the protected resource is within a second domain, the time value comprising a period of time specific to the protected resource following a last successful authentication using a credential before the credential needs to be re-authenticated, the period of time specific to the protected resource overriding a subset of the global session settings in the memory on a per-resource or per-application basis;

monitoring a user's server-side session maintained by the processor in the memory in which a user is authenticated to access the protected resource, the monitoring comprising determining, by the processor, a period of time since the last successful authentication of the user based on information stored in the user's server-side session;

transitioning the user's server-side session from a first state in the session lifecycle to a second state in the session lifecycle based upon determining that the period of time since the last successful authentication of the user exceeds or equals the time value for the server-side sessions configured with access to the protected resource when the protected resource is within a second domain, the second state comprising an idle state or an expired state;

generating, by the computer systems, information in the user's server side session in the memory denying the user access to the protected resource based on the second state until the user is re-authenticated.

2. The method of claim 1 further comprising providing a configurable time value for the server-side sessions specifying the period of time following the last successful authentication using the credential before the credential needs to be re-authenticated.

3. The method of claim 1 wherein receiving the time value for the server-side sessions comprises receiving a configurable time value specific to at least one domain group in a plurality of domain groups having access to the protected resource.

4. The method of claim 1 wherein receiving the time value for the server-side sessions comprises receiving a configurable time value that overrides a default configuration of at least one domain group in a plurality of domain groups having access to the protected resource.

5. The method of claim 1 wherein receiving the time value for the server-side sessions comprises receiving a configurable time value that isolates at least one domain group in a plurality of domain groups from other domain groups in a plurality of domain groups having access to the protected resource.

6. A method of controlling access to a protected resource, the method comprising:

at an access manager server having a hardware processor and a memory storing a user session with access to the protected resource, the user session having a session lifecycle:

receiving a configurable time value for sessions maintained by the processor with access to the protected resource when the protected resources is within a first domain, wherein the configurable time value specifies a period of time that the session remains active with respect to the protected resource when in the first domain that is independent of a period of time all sessions remain active with respect to the protected resource when in a second domain;

monitoring the user session to determine a period of time the user session is active; and

upon determining that the period of time the user session is active exceeds the configurable time value:

denying the user access to the protected resource in the user session, causing the user session to expire thereby ending the session lifecycle, opening a new session for the user, and granting the user access to the protected resource in the new session upon re-authentication of the user; or

denying the user access to the protected resource in the user session, causing the user session to enter an idle state in the session lifecycle, and granting the user access to the protected resource in the user session upon re-authentication of the user and transitioning the user session from the idle state to an active state in the session lifecycle.

7. A non-transitory computer-readable medium storing a computer program product which when executed by a hardware processor of a computer cause the processor to control access to a protected resource, the non-transitory computer-readable medium comprising:

code that causes the processor to receive a time value for server-side sessions maintained by the processor using a session lifecycle, the session lifecycle comprising creation, updates, idleness, and expiration, the server-side sessions configured with access to the protected resource when the protected resource is within a second domain, the time value comprising a period of time specific to the protected resource following a last successful authentication using a credential before the credential needs to be re-authenticated, the period of time specific to the protected resource overriding a subset of global session settings in the memory on a per-resource or per-application basis;

code that causes the processor to monitor a user's server-side session maintained by the processor in which a user is authenticated to access the protected resource, the monitoring comprising determining a period of time since the last successful authentication of the user based on information stored in the user's server-side session;

code that causes the processor to transition the user's server-side session from a first state in the session lifecycle to a second state in the session lifecycle based upon determining that the period of time since the last successful authentication of the user exceeds or equals the time value for the server-side sessions configured with access to the protected resource when the protected resource is within a second domain, the second state comprising an idle state or an expired state;

code that causes the processor to generate information in the user's server side session denying the user access to the protected resource based on the second state until the user is re-authenticated.

8. The non-transitory computer-readable medium of claim 7 further comprising code that causes the processor to provide a configurable time value for the server-side sessions specifying the period of time following the last successful authentication using the credential before the credential needs to be re-authenticated.

9. The non-transitory computer-readable medium of claim 7 wherein the code that causes the processor to receive the time value for the server-side sessions comprises code that causes the processor to receive a configurable time value specific to at least one domain group in a plurality of domain groups having access to the protected resource.

10. The non-transitory computer-readable medium of claim 7 wherein the code that causes the processor to receive the time value for the server-side sessions comprises code that causes the processor to receive a configurable time value that overrides a default configuration of at least one domain group in a plurality of domain groups having access to the protected resource.

11. The non-transitory computer-readable medium of claim 7 wherein the code that causes the processor to receive the time value for the server-side sessions comprises code that causes the processor to receive a configurable time value that isolates at least one domain group in a plurality of domain groups from other domain groups in a plurality of domain groups having access to the protected resource.

12. The method of claim 6 further comprising receiving information for the configurable time value for the server-side sessions specifying the period of time following the last successful authentication using the credential before the credential needs to be re-authenticated.

13. The method of claim 6 wherein providing the configurable time value for the session comprises providing the configurable time value specific to at least one domain group in a plurality of domain groups having access to the protected resource.

14. The method of claim 6 wherein providing the configurable time value for the session comprises providing the configurable time value that overrides a default configuration of at least one domain group in a plurality of domain groups having access to the protected resource.

15. The method of claim 6 wherein providing the configurable time value for the session comprises providing the configurable time value that isolates at least one domain group in a plurality of domain groups from other domain groups in a plurality of domain groups having access to the protected resource.