``` 5. Add the settings you need. For example, use `publicOrigin` in load-balanced scenarios or `minIncomingSigningAlgorithm` if you want to change the default SHA256 option. 6. Save the files and restart the Identity Server web application in IIS. If you encounter any errors with the SAML configuration, error events should be visible in your logs. You can use Windows Event Viewer, the default tool for this purpose. ## Updating the Bearer Token Expiration Orchestrator's `UiPath.Orchestrator.dll.config` file does not offer a way to update the bearer token expiration time. Changes are possible only by adjusting the `AccessTokenLifetime` property of the `Orchestrator.Ropc` client in the Identity Server’s `Clients` database. In the following example, the bearer token expiration time is set to 86400 seconds (24 hours). ``` UPDATE [identity].[Clients] SET AccessTokenLifetime = 86400 WHERE ClientName = 'Orchestrator.Ropc' ``` ## Setting a Timeout Interval for the Management Portals Orchestrator's `UiPath.Orchestrator.dll.config` file does not offer a way to update the expiration time for the token used to authenticate to the host- and organization-level Management portals. Therefore, user sessions do not time out. To set a time interval for timeout for these portals, you can update the `accessTokenLifetime` property by following the below instructions: ### A. Via API 1. Obtain a [client installation token](https://docs.uipath.com/orchestrator/standalone/2022.10/user-guide/host-authentication-settings) for the host. 2. Log out the system administrator user. 3. Navigate to the Identity Server Swagger API at `https:///identity/swagger`. 4. Authorize using `Bearer `, where the `` value is the one obtained at step 1. 5. Retrieve client details using GET `/api/Client/6654E78D-8490-4ABE-9C40-D28267C89F3A`. 6. Copy the response body and change the `accessTokenLifetime` property value to the desired token expiration value (in seconds). 7. Use the edited response body in a PUT `/api/Client/6654E78D-8490-4ABE-9C40-D28267C89F3A` request. 8. Verify that the response body contains the updated value for the `accessTokenLifetime` property. ### Via SQL The below example sets the timeout interval to 86400 seconds (24 hours): ``` UPDATE [identity].[Clients] SET AccessTokenLifetime = 86400 WHERE ClientName = 'Portal.OpenId' ``` ## Intermittent 404 Error When Logging Out The request to log out can sometimes have a URL query string that exceeds the default maximum query string length allowed by IIS. Here are two ways to modify this setting: :::important Changes to the `web.config` are not preserved on upgrade as of the 2021.10 release. ::: ### Using the IIS Manager Tool 1. In the **Connections** tree, navigate to **Sites** -> **UiPath Orchestrator** -> **Identity**. 2. Double-click the **Request Filtering** icon. 3. On the right-side pane, click **Edit Feature Settings**. 4. Increase the value for **Maximum query string (Bytes)**. Figure 2. Edit Request Filtering Settings ![Screenshot of the Edit Request Filtering Settings page](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-screenshot-of-the-edit-request-filtering-settings-page-222910-d52230c8.webp) :::note You may also want to increase the **Maximum URL length (Bytes)** since the query string is part of the overall URL length. ::: ### Modifying Identity Web.config 1. Find the `web.config` file for Identity. * By default, this is `C:\Program Files (x86)\UiPath\Orchestrator\Identity\web.config` for `MSI` installations. * For Azure App Service installations, open the **App Service Editor** under **Development Tools** and navigate to `wwwroot/Web/web.config`. Make sure you are modifying Identity, and not Orchestrator. 2. Open with a text editor and find the **requestFiltering** node, which is under the **security** node. Under **requestFiltering**, add a **requestLimits** node as shown below: ``` ``` ## Upgrade Fails With Timeout Upgrades to 2022.4 may fail with a timeout error due to an Identity Server database issue. To fix the problem, you must run the following script and retry the operation. :::important Running the following script invalidates all tokens, and requires all applications and robots to reauthenticate. ::: ``` DELETE [identity].[PersistedGrants] WHERE [Expiration] < GETUTCDATE() DECLARE @ConsumedTime DATETIME = DATEADD(SECOND, -7200, GETUTCDATE()) DELETE [identity].[PersistedGrants] WHERE [ConsumedTime] IS NOT NULL AND [ConsumedTime] < @ConsumedTime ``` ## 404 when user in multiple tenants attempts authentication Users who are part of multiple tenants encounter a "Error while contacting partition service to validate the organization (#404)" error during authentication. This error occurs because the request to authenticate exceeds the default query string length limit in IIS (2048 characters), especially for users are associated with a significant number of tenants (typically more than 30 tenants). To address this issue, you can adjust the query string length limit in IIS. ### Using the IIS Manager Tool 1. In the **Connections** tree, navigate to **Sites** -> **UiPath Orchestrator** -> **Identity**. 2. Double-click the **Request Filtering** icon. 3. On the right-side pane, click **Edit Feature Settings**. 4. Increase the value for **Maximum query string (Bytes)**. Figure 3. Edit Request Filtering Settings ![Screenshot of the Edit Request Filtering Settings page](https://dev-assets.cms.uipath.com/assets/images/orchestrator/orchestrator-screenshot-of-the-edit-request-filtering-settings-page-222910-d52230c8.webp) :::note You may also want to increase the **Maximum URL length (Bytes)** since the query string is part of the overall URL length. ::: ### Modifying Identity Web.config 1. Find the `web.config` file for Identity. * By default, this is `C:\Program Files (x86)\UiPath\Orchestrator\Identity\web.config` for `MSI` installations. * For Azure App Service installations, open the **App Service Editor** under **Development Tools** and navigate to `wwwroot/Web/web.config`. Make sure you are modifying Identity, and not Orchestrator. 2. Open with a text editor and find the **requestFiltering** node, which is under the **security** node. Under **requestFiltering**, add a **requestLimits** node as shown below: ``` ``` ## AD Operations Fail After Upgrade to Orchestrator 2021.10+ After updating to Orchestrator Standalone 2021.10+, AD operations start to fail when trying to authenticate. :::note A temporary fix is to set **loadUserProfile** in IIS to **True**. :::