SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am facing an issue regarding the authentication in SP 2010. The scenario is below:

WindowsTokenLifetime, FormsTokenLifetime and ServiceTokenLifetime are set to 365 days.

  1. Login with the user on the site
  2. FedAuth is created for 1 year validity.
  3. Don't log out and close the browser and wait for a day or two and open the same browser again. I can find the user is logged in but his rights are not proper.
  4. But I can see the FedAuth key in the browser.

Can anyone help me know what could be the reason??

Thanks in advance

share|improve this question
I found the solution but I am not sure about the problem. I re authenticated the user on every session start for Global.asax file. Any one who find this kind of issue can look at this solution to create Global.asax file… – Ankit Dec 21 '12 at 10:07

This is because SharePoint 2010 also creates an auth cookie which is saved to local file. The trick is to force SharePoint 2010 to use a session-based cookie, so that it is destroyed when the page is closed. In order to do that, run the following PowerShell script on the SharePoint WFE:

$sts = Get­SPSecurityTokenServiceConfig
$sts.UseSessionCookies = $true

Now with the SharePoint AND ADFS cookies being session based, the user can log off by simply closing their browser window.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.