Repository: goauthentik/authentik

Issue:
Session duration not working correctly
**Describe the bug**
I changed the session duration of the default-authentication-login to 18 hours. Still, after a login the session is valid for 14 days.
For me, it looks like the session duration value is ignored.

**To Reproduce**
Steps to reproduce the behavior:
1. Go to 'Admin interface'
2. Click on 'Flows & Stages'
3. Edit 'default-authentication-login'
4. Change 'Session duration' to 'hours=18;minutes=0;seconds=0'
5. Logout & Login
6. Click on the settings-icon (“wheel”)
7. Check the session duration.

**Expected behavior**
I want to achieve, that every user has to authenticate once a day. Therefore, the session duration of 18 hours. 

**Screenshots**
![image](https://user-images.githubusercontent.com/7803347/224706556-5ec007cf-9b0c-4aeb-9160-d6d779bfcc7b.png)
![image](https://user-images.githubusercontent.com/7803347/224707352-97c11b3c-672b-4355-bbb9-e603522217cb.png)


**Logs**
There are no logs.

**Version and Deployment (please complete the following information):**
 - authentik 2023.1.2
 - Deployment: docker-compose



Discussion:

Resolving patch:
diff --git a/authentik/stages/user_login/stage.py b/authentik/stages/user_login/stage.py
--- a/authentik/stages/user_login/stage.py
+++ b/authentik/stages/user_login/stage.py
@@ -32,16 +32,16 @@ def get(self, request: HttpRequest) -> HttpResponse:
         user: User = self.executor.plan.context[PLAN_CONTEXT_PENDING_USER]
         if not user.is_active:
             self.logger.warning("User is not active, login will not work.")
-        login(
-            self.request,
-            user,
-            backend=backend,
-        )
         delta = timedelta_from_string(self.executor.current_stage.session_duration)
         if delta.total_seconds() == 0:
             self.request.session.set_expiry(0)
         else:
             self.request.session.set_expiry(delta)
+        login(
+            self.request,
+            user,
+            backend=backend,
+        )
         self.logger.debug(
             "Logged in",
             backend=backend,


Test patch:
diff --git a/authentik/stages/user_login/tests.py b/authentik/stages/user_login/tests.py
--- a/authentik/stages/user_login/tests.py
+++ b/authentik/stages/user_login/tests.py
@@ -5,6 +5,7 @@
 from django.contrib.sessions.backends.cache import KEY_PREFIX
 from django.core.cache import cache
 from django.urls import reverse
+from django.utils.timezone import now
 
 from authentik.core.models import AuthenticatedSession
 from authentik.core.tests.utils import create_test_admin_user, create_test_flow
@@ -16,6 +17,7 @@
 from authentik.flows.views.executor import SESSION_KEY_PLAN
 from authentik.lib.generators import generate_id
 from authentik.lib.utils.http import DEFAULT_IP
+from authentik.lib.utils.time import timedelta_from_string
 from authentik.stages.user_login.models import UserLoginStage
 
 
@@ -103,6 +105,13 @@ def test_expiry(self):
         self.assertEqual(response.status_code, 200)
         self.assertStageRedirects(response, reverse("authentik_core:root-redirect"))
         self.assertNotEqual(list(self.client.session.keys()), [])
+        session_key = self.client.session.session_key
+        session = AuthenticatedSession.objects.filter(session_key=session_key).first()
+        self.assertAlmostEqual(
+            session.expires.timestamp() - now().timestamp(),
+            timedelta_from_string(self.stage.session_duration).total_seconds(),
+            delta=1,
+        )
         sleep(3)
         self.client.session.clear_expired()
         self.assertEqual(list(self.client.session.keys()), [])