# Okta-Pritunl deprovisioning

**URL:** <https://forum.pritunl.com/t/okta-pritunl-deprovisioning/1582>\
**Category:** Pritunl VPN\
**Created:** [November 28, 2023, 7:42am UTC](https://forum.pritunl.com/t/okta-pritunl-deprovisioning/1582 "2023-11-28T07:42:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ppn](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/p/f07891/32.png) [@ppn](https://forum.pritunl.com/u/ppn)\
**Post date:** [November 28, 2023, 7:42am UTC](https://forum.pritunl.com/t/okta-pritunl-deprovisioning/1582/1 "2023-11-28T07:42:44Z")

</div>

Hi,  
We have Pritunl Enterprice connected with Okta via Pritunl app in Okta.

 ![image](https://forum-static.pritunl.com/original/1X/de81ae40d3a7ec867a81d4bbccc0f9681cc78ebd.png)

Some of our employees use OpenVPN Connect, some Pritunl Client.  
Correct workflow of deactivation the user who connected with Pritunl client:

1. User in Okta deactivated,
2. Active Pritunl VPN connection drops and user can’t connect to our VPN,
3. Profit.

Incorrect workflow with OpenVPN Connect:

1. User in Okta deactivated,
2. Active OpenVPN Connect connection still active and healthy. Only when the user manually disconnects, they can’t reconnect. Update: default time is 60 minutes (app.sso\_connection\_check\_ttl)

Right now I have only ability to manually drop connection by deleting him or push “Disable and disconnect user” button in admin dashboard.

Can it somehow be configured to automatically drop active connections when employee deactivated in Okta?

Thanks!

---

<div class="post-metadata">

**Author:** ![ppn](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/p/f07891/32.png) [@ppn](https://forum.pritunl.com/u/ppn)\
**Post date:** [November 29, 2023, 6:54am UTC](https://forum.pritunl.com/t/okta-pritunl-deprovisioning/1582/2 "2023-11-29T06:54:19Z")

</div>

> [@Pritunl v1.32.3504.68](https://forum.pritunl.com/t/pritunl-v1-32-3504-68/1018#single-sign-on-verification-3):
>
> [Pritunl v1.32.3504.68](https://github.com/pritunl/pritunl/releases/tag/1.32.3504.68) has been released. This update adds device authentication, Python 3.9, improved single sign-on verification and improved web server security. Device Authentication [Device authentication](https://docs.pritunl.com/docs/device-authentication) is a new authentication factor that utilizes the client TPM or Apple Secure Enclave. When a user connects to a server with device authentication for the first time the user will be prompted to contact an administrator with a pin to approve the users physical device. This pi…

I found this in release notes, and the question is - can it be changed to less than 30 minutes?

 ![image](https://forum-static.pritunl.com/original/1X/b50b5d0aeb052b5273a35e7f5f00a190de4df6e9.png)

---

<div class="post-metadata">

**Author:** ![ppn](https://forum.pritunl.com/letter_avatar_proxy/v4/letter/p/f07891/32.png) [@ppn](https://forum.pritunl.com/u/ppn)\
**Post date:** [November 29, 2023, 11:26am UTC](https://forum.pritunl.com/t/okta-pritunl-deprovisioning/1582/3 "2023-11-29T11:26:09Z")

</div>

Solved by executing this command:

```auto
sudo pritunl set app.sso_connection_check_ttl xxxxx

```

where xxxxx - time in seconds.

Actual setting can be checked with this command:

```auto
sudo pritunl get app.sso_connection_check_ttl

```

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [November 30, 2023, 7:00pm UTC](https://forum.pritunl.com/t/okta-pritunl-deprovisioning/1582/4 "2023-11-30T19:00:24Z")

</div>

The single sign-on check during connection is only available in recent releases. This will re-sync the single sign-on user status at the interval set by `app.sso_connection_check_ttl`. It is enabled by default at a 1 hour interval. Reducing this interval may cause API limit errors from the single sign-on provider.