1

I am using ADFS 2.0 for authentication for my mvc 3.0 web app. I set my TokenLifeTime on my relying party to 1440 (24 hours), but when I step through my code after I log in I can see that the ValidTo date of the session token is only 600 mins (10 hours) from now. If I change TokenLifeTime to be less than 600 the datetime matches what I expect when I log in. i.e. if I set TokenLifeTime to 5, the ValidTo date on my session token is 5 mins from when I logged in.

I haven't found any reference to a maximum number for this value, but I also haven't been able to account for why I can't increase the ValidTo time on my session token to longer than 600 mins.

So...

Is 600 the maximum value for TokenLifeTime?

Is there anything else that affects the ValidTo time on the session tokens issued by ADFS?

2
  • I am not sure whether or not the SsoLifeTime property affects this, can't verify it now. Could you possitly check what the actual value is and if it is 600, make it 1440? (Set-AdfsProperty, Get-AdfsProperty). Sep 27, 2013 at 21:28
  • WebSSOLifeTime is also set to 1440. no affect.
    – Ben Tidman
    Sep 28, 2013 at 3:24

1 Answer 1

2

I've been looking at this and I think I've come up with a working solution - I've not used it in anger yet so I can't be sure that it doesn't contain any issues!

Essentially it intercepts the token after it has been created but before anything has started using it. Then replaces it with a token that contains all the underlying detail of the original but with a much longer validTo date, as decided by the value of validForDays

void WSFederationAuthenticationModule_SessionSecurityTokenCreated(object sender, SessionSecurityTokenCreatedEventArgs e)
{
    var currentToken = e.SessionToken;
    var validForDays = 1;

    e.SessionToken = new SessionSecurityToken(
        currentToken.ClaimsPrincipal,
        currentToken.Context,
        currentToken.EndpointId,
        DateTime.UtcNow,
        DateTime.UtcNow.AddDays(validForDays));

    e.SessionToken.IsPersistent = true;
}

This lives in Global.asax.cs

2
  • 1
    This looks promising. I ended up doing something similar using SessionAuthenticationModule_SessionSecurityTokenReceived but it's more of a sliding window as people continue to be active on my site. The only caution that I have with mine is that sometimes the cookie corrupts itself when you edit it. Probably only an issue if you are using encrypted tokens. Thanks for the answer.
    – Ben Tidman
    Dec 12, 2013 at 14:26
  • 1
    I had a look at doing it in the SessionAuthenticationModule_SessionSecurityTokenReceived but it didn't feel like the right place as it would have to perform the check every time anything was requested from the server by an authenticated user. When you say you edit the cookie do you use e.ReissueCookie = true;?
    – James
    Dec 13, 2013 at 11:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.