The DefaultAuthenticatorStore should set the configured idleTimeout.

The cache based DefaultAuthenticatorStore does not specify the timeToLive when saving an authenticator. AFAICS this means, that when the authenticator is removed from the cache due to the default cache TTL, the user is logged out, even if the configured idleTimeout is not reached.

With the attached commit the DefaultAuthenticatorStore uses the configured idleTimeout when putting the authenticator into the cache.
Then one can also make use of ehcache's configuration "diskPersistent" to have some kind of durability for user sessions (of course only for single server setup, simplest setups).