1

I am facing an issue regarding the authentication in SP 2010. The scenario is below:

WindowsTokenLifetime, FormsTokenLifetime and ServiceTokenLifetime are set to 365 days.

  1. Login with the user on the site
  2. FedAuth is created for 1 year validity.
  3. Don't log out and close the browser and wait for a day or two and open the same browser again. I can find the user is logged in but his rights are not proper.
  4. But I can see the FedAuth key in the browser.

Can anyone help me know what could be the reason??

Thanks in advance

Improve this question
1
  • I found the solution but I am not sure about the problem. I re authenticated the user on every session start for Global.asax file. Any one who find this kind of issue can look at this solution to create Global.asax file doitwithsharepoint.blogspot.dk/2011/02/…
    – Ankit
    Commented Dec 21, 2012 at 10:07

1 Answer 1

Reset to default
0

This is because SharePoint 2010 also creates an auth cookie which is saved to local file. The trick is to force SharePoint 2010 to use a session-based cookie, so that it is destroyed when the page is closed. In order to do that, run the following PowerShell script on the SharePoint WFE:

$sts = Get­SPSecurityTokenServiceConfig
$sts.UseSessionCookies = $true
$sts.Update()
iisreset

Now with the SharePoint AND ADFS cookies being session based, the user can log off by simply closing their browser window.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.