Role enforced despite not being selected.

Not sure this should be considered a bug... or just a bad implementation. At a minimum, the UI does not sufficiently explain what these check boxes do. I think that if you deselect a role then users with that role should not be logged out regardless of what other roles they have.

However, with the current code it does not matter what roles you deselect, as long as you have "authenticated user" checked, everyone will get logged out since no one can have any of the other roles if they are not also an "authenticated user". Not to mention, if a user is not an "authenticated user" then we don't need to log them out any way. We have the situation where we have an "administrator" role (using another module that grants nearly all admin rights to this role) and we would like users that we have with this role to be exempt from being logged out. But even with that role deselected, they are getting logged out because they are also have the "authenticated user" role.

I've taken the function that checks if the user should have auto logout enforced based on role and reversed all the Boolean logic.

So instead of looping through the list of roles and immediately returning TRUE when it finds a role marked as TRUE like this:

 // Old code
function _autologout_logout_role($user) {
  foreach ($user->roles as $key => $role) {
    if (variable_get('autologout_role_' . $key, FALSE)) {
      return TRUE;
    }
  }  
  
  return FALSE;
}

It now loops through the list of roles and returns a FALSE as soon as it finds a roll marked as FALSE like this:

 //New code
function _autologout_logout_role($user) {
  foreach ($user->roles as $key => $role) {
    if (!variable_get('autologout_role_' . $key, TRUE)) {
      return FALSE;
    }
  }  
  
  return TRUE;
}

This issue is related to the bug reported at #992816: Autologout is active for disabled roles.

Marking as duplicate of http://drupal.org/node/1700706

This issue should be fixed by the pending backport on this issue