What version of ArubaOS is this?
There is another idle timeout that can be set in the aaa profile. Type "show user-table" and find your user. In the "profile" column, will be the AAA profile that is assigned to that user. Type "show aaa profile <that aaa profile>". You should see below:
(Aruba7660-US) # show aaa profile employee-aaa_prof
AAA Profile "employee-aaa_prof"
-------------------------------
Parameter Value
--------- -----
Initial role authenticated
MAC Authentication Profile N/A
MAC Authentication Default Role guest
MAC Authentication Server Group default
802.1X Authentication Profile dot1x_prof-skn93
802.1X Authentication Default Role authenticated
802.1X Authentication Server Group employee-srvgrp-vrk60
Download Role from CPPM Disabled
Set username from dhcp option 12 Disabled
L2 Authentication Fail Through Disabled
Multiple Server Accounting Disabled
User idle timeout 0 sec
Max IPv4 for wireless user 2
RADIUS Accounting Server Group N/A
RADIUS Roaming Accounting Disabled
RADIUS Interim Accounting Disabled
XML API server 192.168.1.236
RFC 3576 server 192.168.1.32
User derivation rules N/A
Wired to Wireless Roaming Disabled
SIP authentication role N/A
Device Type Classification Enabled
Enforce DHCP Disabled
PAN Firewall Integration Disabled
Open SSID radius accounting Disabled
If this is a guest user, the captive portal authentication profile for that user also has a user idle timeout that can override the global user idle timeout.