# Aggressive forced reauths - YubiKey + Google SSO

**URL:** <https://forum.pritunl.com/t/aggressive-forced-reauths-yubikey-google-sso/2331>\
**Category:** Pritunl VPN\
**Tags:** pritunl\
**Created:** [September 3, 2024, 6:06pm UTC](https://forum.pritunl.com/t/aggressive-forced-reauths-yubikey-google-sso/2331 "2024-09-03T18:06:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![aravind](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/a/e8c25b/32.png) [@aravind](https://forum.pritunl.com/u/aravind)\
**Post date:** [September 3, 2024, 6:06pm UTC](https://forum.pritunl.com/t/aggressive-forced-reauths-yubikey-google-sso/2331/1 "2024-09-03T18:06:21Z")

</div>

We are currently running this setup:

pritunl v1.32.3897.75  
Clients are mostly using the recent official pritunl clients. These are our cache settings:

```auto
/opt/pritunl # pritunl get app.sso_cache
app.sso_cache = false
/opt/pritunl # pritunl get app.sso_client_cache
app.sso_client_cache = true
/opt/pritunl # pritunl get app.sso_cache_timeout
app.sso_cache_timeout = 28800
/opt/pritunl # pritunl get app.sso_client_cache_timeout
app.sso_client_cache_timeout = 604800

```

We are finding that while the cache is working well for some folks, it is causing others to be prompted to use their YubiKey multiple times in a day sometimes.

Is there anything that can help us troubleshoot this - where/how can we figure out what is causing this excessive re-authentication?

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [September 4, 2024, 8:45pm UTC](https://forum.pritunl.com/t/aggressive-forced-reauths-yubikey-google-sso/2331/2 "2024-09-04T20:45:39Z")

</div>

If the options were changed the profile needs to resync with the server. Click settings in the client and check the last configuration sync. This timestamp only changes if a changed configuration was updated. If the sync does not work the client will retain the old configuration which may not have the cache enabled. The profile can be imported again to update.