Keep Them Signed In
Customers can sign in, but nothing remembers them. Every visit starts at an empty sign-in screen, even a visit that began a minute ago in the same browser.
Sessions
A session is a note ThunderID keeps after someone signs in. Next time, ThunderID reads the note instead of asking again. Two limits decide how long it lasts:
| Limit | What it does | Default |
|---|---|---|
| Idle | Ends the session after this long with no activity. Each visit resets the clock. | 30 minutes |
| Absolute | Ends the session this long after it started, whatever the customer does. | 8 hours |
The first limit to run out wins. You set both once for the whole deployment. See Configure Session Lifetime.
The note stays on the server, and the browser only gets a cookie pointing to it. So a customer signed in on a laptop is not signed in on their phone.
Checkpoints
Two nodes tell ThunderID which steps it may skip:
- Check SSO Session asks whether a session already covers the next step. SSO is short for Single Sign-On.
- Save / Load Session is the checkpoint. It saves the result the first time, and loads it back later.
The steps between them are the ones a session can skip.
Around the password step, a returning customer skips the password. Keep a second factor outside the nodes and ThunderID asks for it every time.
One Sign-In, Several Applications
The checkpoint belongs to the flow, not to the application that ran it. Applications on the same flow share one session, and applications on different flows never do. That sharing is Single Sign-On, and there is nothing to switch on.
Wayfinder ships with one application, so the steps below add the checkpoint to that one. A second application joins the same flow through a single dropdown, covered in Register the Application.
Add the two nodes to the flow
Navigate to Flows and open Wayfinder App Authentication Flow. In the Flow Builder:
- Add a Check SSO Session node after the start, before the password prompt. Connect its Authenticate outcome to that prompt.
- Add a Save / Load Session node after the password check.
- Connect the password check to it, and the Skip to outcome of Check SSO Session as well. Then carry on to the step that issues the token.
Both paths meet at one node, so the token comes out the same either way. Save the flow. See Single Sign-On for Flows.
