# Override SSO Session Settings at user level

**URL:** <https://forum.keycloak.org/t/override-sso-session-settings-at-user-level/31249>\
**Category:** Getting advice\
**Created:** [January 13, 2026, 3:28pm UTC](https://forum.keycloak.org/t/override-sso-session-settings-at-user-level/31249 "2026-01-13T15:28:21Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![jmcrthrs](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jmcrthrs/32/12315_2.png) [@jmcrthrs](https://forum.keycloak.org/u/jmcrthrs)\
**Post date:** [January 13, 2026, 3:28pm UTC](https://forum.keycloak.org/t/override-sso-session-settings-at-user-level/31249/1 "2026-01-13T15:28:21Z")

</div>

It is possible to override the SSO Session Settings at the Client level.

Is it also possible to override them at USer level, so individual users can decide their own session expiry time.

 ![Screenshot 2026-01-13 at 16.25.07](https://global.discourse-cdn.com/free1/uploads/keycloak/original/2X/a/a1f7e78bc4d49aba20214fa246fd01cb2b6615e9.png)

---

<div class="post-metadata">

**Author:** ![embesozzi](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/embesozzi/32/12390_2.png) [@embesozzi](https://forum.keycloak.org/u/embesozzi)\
**Post date:** [January 13, 2026, 6:42pm UTC](https://forum.keycloak.org/t/override-sso-session-settings-at-user-level/31249/2 "2026-01-13T18:42:26Z")

</div>

The user does not decide the session expiration. Session lifetime is not within the user’s domain to control.

---

<div class="post-metadata">

**Author:** ![jmcrthrs](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jmcrthrs/32/12315_2.png) [@jmcrthrs](https://forum.keycloak.org/u/jmcrthrs)\
**Post date:** [January 13, 2026, 9:52pm UTC](https://forum.keycloak.org/t/override-sso-session-settings-at-user-level/31249/3 "2026-01-13T21:52:44Z")

</div>

Ok so there are no properties on the user record that could support such a feature and it isn’t likely to be added in the future?

---

<div class="post-metadata">

**Author:** ![embesozzi](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/embesozzi/32/12390_2.png) [@embesozzi](https://forum.keycloak.org/u/embesozzi)\
**Post date:** [January 13, 2026, 11:27pm UTC](https://forum.keycloak.org/t/override-sso-session-settings-at-user-level/31249/4 "2026-01-13T23:27:15Z")

</div>

In my experience, I haven’t seen any IdP that supports that feature (Keycloak, OpenAM, Gluu, Entra, ForgeRock, Ping, Auth0, etc). Setting the expiration is done at the global or client level, not at the user level.

---

<div class="post-metadata">

**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\
**Post date:** [January 14, 2026, 11:54am UTC](https://forum.keycloak.org/t/override-sso-session-settings-at-user-level/31249/5 "2026-01-14T11:54:49Z")

</div>

To be even more precise: in Keycloak you only have 1 SSO (user) session with an expiration. At client level, only the related client session can expire differently. But for the expiration of the user session itself there is only a global value per realm!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/free1/uploads/keycloak/original/1X/eb342909d95cf32cbb7517610022c6a0046a9ffb.png) [@system](https://forum.keycloak.org/u/system)\
**Post date:** [January 16, 2026, 11:55am UTC](https://forum.keycloak.org/t/override-sso-session-settings-at-user-level/31249/6 "2026-01-16T11:55:46Z")

</div>

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.