ForgeRock Identity Platform
Does not apply to Identity Cloud

401 Unauthorized: Session has timed out response when authenticating to AM (All versions)

Last updated Apr 12, 2021

The purpose of this article is to provide assistance if you receive a "Session has timed out" response when authenticating to a single module in AM. This error occurs when you have a multi-server setup in a load balanced environment that does not use session stickiness (amlbcookie).

2 readers recommend this article


The browser stops responding after the user enters their credentials.

The following response is shown if you use a REST call or examine network traffic using your browser's Developer Tools:

{"code":401,"reason":"Unauthorized","message":"Session has timed out"}

The corresponding error is shown in the Authentication debug log:

Caused by: com.sun.identity.authentication.service.AuthException: Session has timed out|session_timeout.jsp    at com.sun.identity.authentication.service.AuthUtils.getAuthContext(     at     at     at     at  ... 83 more  Caused by: com.sun.identity.authentication.service.AuthException: Session has timed out|session_timeout.jsp

Recent Changes

Installed AM or upgraded to a later version.

Implemented or changed your load balancing configuration so that it does not have session stickiness.


Sticky load balancing is a requirement in AM for all module-based authentication scenarios as noted in the following known issues: OPENAM-12675 (One-step authentication in a cluster requires sticky load balancing) and OPENAM-8336 (XUI+REST authentication with chains must have sticky load balancing). Without sticky load balancing, the load balancer may not send the request to the right AM server, which causes this error.


This issue can be resolved using one of the following options as appropriate to your environment:

  • Implement sticky load balancing using the amlbcookie. See FAQ: Cookies in AM for further information on using the amlbcookie for load balancing.
  • Use Active/Passive configuration for the AM nodes; providing each node can handle the traffic volume, you will still have failover but ensure traffic is routed to the correct server.
  • Upgrade to AM 6 or later; you can download this from BackStage. You can then migrate to authentication trees and configure the storage location for authentication sessions so they are not stored in memory. See the following links for further information:

See Also

Required callback not found in JSON response when authenticating to AM (All versions)

Cookies in AM

Setup Guide › Load Balancers

Sessions Guide › Choosing Where to Store Sessions

Related Training


Related Issue Tracker IDs


Copyright and Trademarks Copyright © 2021 ForgeRock, all rights reserved.