I'm having trouble where my sessions aren't closing after the 60 minute
timeout. I'm checking to see how long the sessions are staying open, and they
are staying open past the 60 minute timeout I have defined. Is there somewhere
else I need to modify something to get them to end?

<cfapplication name="PerformanceEvals"
sessionmanagement="yes"
sessiontimeout="#CreateTimeSpan(0,0,60,0)#">

<CFLOCK TIMEOUT="60" NAME="#session.sessionID#" TYPE="Exclusive">
<cfset ntlogin = #listlast(cgi.auth_user,"\")#>
<cfset session.lastUpdated = "#DateFormat(now(), "mm/dd/yyyy")#
#TimeFormat(now(), "HH:mm")#">
<cfset session.pathinfo = #cgi.PATH_INFO#>
<cfset session.computer = #cgi.REMOTE_ADDR#>

<cfif NOT IsDefined("session.ntlogin") or (IsDefined("URL.ldap") and (URL.ldap
eq 'query'))>
<cfldap
server = "ha2000dc3.ha2000.com"
action = "query"
name = "results"
start = "DC=ha2000,DC=com"
filter="samAccountName=#ntlogin#"
attributes="cn,displayname,title,mail,member,membe rof,sn,givenName"
username="Hercules"
password="P3g@sus"
sort = "cn ASC">

<cfparam name='session.access' default="">
<cfset session.ntlogin = #listlast(cgi.auth_user,"\")#>
<cfoutput query="results">
<cfset session.givenName = '#givenName#'>
<cfset session.mail = '#mail#'>
<cfset session.memberof = '#memberof#'>
<cfset session.displayName = '#displayname#'>
<cfset session.sn = '#sn#'>
<cfset session.startTime = "#DateFormat(now(), "mm/dd/yyyy")#
#TimeFormat(now(), "HH:mm")#">
<cfloop index="group" list=#session.memberof# delimiters=",">
<cfif #Trim(group)# eq 'CN=Performance Admins'>
<cfset session.access='admin'>
<cfbreak>
<cfelseif #Trim(group)# eq 'CN=Executive Assistants'>
<cfset session.access='user'>
<cfbreak>
<cfelseif #Trim(group)# eq 'CN=Supervisors'>
<cfset session.access='manager'>
<cfbreak>
<cfelseif #Trim(group)# eq 'CN=_Department_Managers'>
<cfset session.access='manager'>
</cfif>
</cfloop>
<cfif Len(session.access) eq 0>
<cfset session.access='user'>
</cfif>
</cfoutput>
</cfif>

<cfif session.access neq 'admin'>
<cferror type="exception" template="errors.cfm" exception="any">
</cfif>

</CFLOCK>

Just want to make sure you understand what a session timing out means.

1) Is this your application.cfm?

2) What do you think is the chain of events that should result in your session ending?

Sorry, yes the attached code is my Application.cfm file

I'd assume that once the timeout is reached the session id and all applicable variables would be deleted. I'm not seeing that occur.

So you are running along and at some point you expect to do a submit of a .cfm
page and you expect that the session variables should no longer be defined. I
generally am not happy with the whole timeout thing either in general. It
seemed I had to jump thru some hoops to get it working the way I expected.

I do notice you selected 60 minutes versus 1 hour. Could this be the problem
that it doesn't like 60 minutes?

Are you solely relying on this to catch the timed out session?

<cfif NOT IsDefined("session.ntlogin") or (IsDefined("URL.ldap") and (URL.ldap
eq 'query'))>

Did you try changing that 60 to something like 10 minutes just to rule that out
as a bug?

Here's an small Application.cfc that works using cflogin with a timeout if
this is of any use to you

<cfcomponent>

<cfset This.name = "yourappname">
<cfset This.Sessionmanagement="True">
<cfset This.loginstorage="session">

<cffunction name="OnRequestStart">
<cfargument name = "request" required="true"/>
<cflogin idletimeout="5">
<cfif NOT IsDefined("cflogin")>
<cfinclude template="loginform.cfm">
<cfabort>
<cfelse>
<cfif cflogin.name IS "" OR cflogin.password IS "">
<cfoutput>
<h2>You must enter both the User Name and Password fields.
</h2>
</cfoutput>
<cfinclude template="loginform.cfm">
<cfabort>
<cfelse>
yourldap lookup
<cfif loginIsGood>
<cfloginuser name="#cflogin.name#" Password="#cflogin.password#"
roles="">
<cfelse>
<cfoutput>
<H2>Your login information is not valid.<br>Please Try again</H2>
</cfoutput>
<cfinclude template="loginform.cfm">
<cfabort>
</cfif>
</cfif>
</cfif>
</cflogin>
</cffunction>
</cfcomponent>

loginform.cfm

<H2>Please Log In</H2>
<cfoutput>
<form action="#CGI.script_name#?#CGI.query_string#" method="Post">
<table>
<tr>
<td>user name:</td>
<td><input type="text" name="j_username"></td>
</tr>
<tr>
<td>password:</td>
<td><input type="password" name="j_password"></td>
</tr>
</table>
<br>
<input type="submit" value="Log In">
</form>
</cfoutput>