Server: Add support for DELETE_EXPIRED_SESSIONS_SCHEDULE to prevent auto-logout when using SAML login

packages/server/src/env.ts

@@ -23,6 +23,7 @@ const defaultEnvValues: EnvVariables = {
 	COOKIES_SECURE: false,
 	RUNNING_IN_DOCKER: false,
 	HEARTBEAT_MESSAGE_SCHEDULE: '* * * * *',
+	DELETE_EXPIRED_SESSIONS_SCHEDULE: '0 */6 * * *',
 	LOG_LEVEL: 'info',
 
 	// The admin panel is accessible only if this is an admin instance.
@@ -185,6 +186,7 @@ export interface EnvVariables {
 	COOKIES_SECURE: boolean;
 	RUNNING_IN_DOCKER: boolean;
 	HEARTBEAT_MESSAGE_SCHEDULE: string;
+	DELETE_EXPIRED_SESSIONS_SCHEDULE: string;
 	LOG_LEVEL: string;
 
 	MAX_TIME_DRIFT: number;

packages/server/src/utils/setupTaskService.ts

@@ -49,13 +49,6 @@ export default async function(env: Env, models: Models, config: Config, services
 			run: (models: Models) => models.user().handleOversizedAccounts(),
 		},
 
-		{
-			id: TaskId.DeleteExpiredSessions,
-			description: taskIdToLabel(TaskId.DeleteExpiredSessions),
-			schedule: '0 */6 * * *',
-			run: (models: Models) => models.session().deleteExpiredSessions(),
-		},
-
 		{
 			id: TaskId.ProcessOrphanedItems,
 			description: taskIdToLabel(TaskId.ProcessOrphanedItems),
@@ -92,6 +85,15 @@ export default async function(env: Env, models: Models, config: Config, services
 		},
 	];
 
+	if (config.DELETE_EXPIRED_SESSIONS_SCHEDULE) {
+		tasks.push({
+			id: TaskId.DeleteExpiredSessions,
+			description: taskIdToLabel(TaskId.DeleteExpiredSessions),
+			schedule: config.DELETE_EXPIRED_SESSIONS_SCHEDULE,
+			run: (models: Models) => models.session().deleteExpiredSessions(),
+		});
+	}
+
 	if (config.USER_DATA_AUTO_DELETE_ENABLED) {
 		tasks.push({
 			id: TaskId.AutoAddDisabledAccountsForDeletion,

readme/apps/server/saml.md

@@ -60,17 +60,32 @@ While and IDP config would look like this:
 
 <!-- cSpell:enable -->
 
-## Required user attributes
+### Required user attributes
 
 Users must have the following attributes configured on your SAML provider:
 
 - `email`: The user email.
 - `displayName`: The user full name.
 
-## API domain
+### API domain
 
 Joplin Server supports using a separate domain for the API calls, using the `API_BASE_URL` env variable. However this setup is **not supported with SAML**. Both API and website must be under the same URL - essentially it means that both `APP_BASE_URL` and `API_BASE_URL` should be set to the same URL.
 
+Your environment file would look like this:
+
+```ini
+APP_BASE_URL=https://myserver.com
+API_BASE_URL=https://myserver.com
+```
+
+### Session expiration
+
+By default Joplin Server automatically clears sessions every 6 hours, forcing clients to login again. This is fine in a context where login can be done via an API, so that the client can automatically login again. However with SAML the user needs to go through the manual login process every time. For this reason it is strongly recommended to disable this task. You can do so by setting `DELETE_EXPIRED_SESSIONS_SCHEDULE` to an empty string, like so:
+
+```ini
+DELETE_EXPIRED_SESSIONS_SCHEDULE=
+```
+
 ## Custom CA certificates
 
 By default, the Joplin Server image does not include the `ca-certificates` which may be needed to get custom certificates for your mail server working. You can install those additional packages (and any other package), using the method below: