Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I have a public facing SP2010 site that uses forms authentication (default ASP.NET membership provider). I noticed that The user stays logged in even after hours of inactivity.

We need the user to be automatically log out and having to re-login before accessing the site again after a period of inactivity (typically 30 minutes).

What can I do in order to force the user to re-login after 30 minutes?

The token is generated using the call

token = SPSecurityContext.SecurityTokenForFormsAuthentication(
                appliesTo,
                authProvider.MembershipProvider,
                authProvider.RoleProvider,
                username,
                password);

For some reason, the token is always valid for 10 hours (validTo property is always 10 hours after the validFrom property). I spent sometime looking in config files to see where this 10 hours is coming from but to no avail.

I then decomipled the SharePoint assembly to see where it is reading the 10 hours setting from.

after tracing the calls I found out that it is hardcoded to 10 hours in the Assembly

Check below (decomplied code)

public virtual SecurityToken GetTokenFromResponse(RequestSecurityToken request, RequestSecurityTokenResponse response)
{
    DateTime? nullable;
    DateTime? expires;
    if (response != null)
    {
        if (response.IsFinal)
        {
            if (response.RequestedSecurityToken != null)
            {
                SecurityToken securityToken = response.RequestedSecurityToken.SecurityToken;
                if (securityToken != null)
                {
                    return securityToken;
                }
                else
                {
                    if (response.RequestedSecurityToken.SecurityTokenXml != null)
                    {
                        SecurityToken proofKey = WSTrustChannel.GetProofKey(request, response);
                        if (response.Lifetime == null)
                        {
                            nullable = new DateTime?(DateTime.UtcNow);
                            DateTime utcNow = DateTime.UtcNow;
                            expires = new DateTime?(utcNow.AddHours(10));
share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

Do the following powershell command:

$sts = Get-SPSecurityTokenServiceConfig
$sts.FormsTokenLifeTime = (New-TimeSpan -minutes 30)
$sts.Update()
Get-SPSecurityTokenServiceConfig
share|improve this answer
    
Thanks a lot, works perfectly. –  Emad Aug 16 '12 at 15:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.