SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It only takes a minute to sign up.
Sign up to join this community
Can I get a good explanation of following terms:
What does WindowsTokenLifetime minus LogonTokenCacheExpirationWindow specify? Similarly what does ServiceTokenLifetime minus ServiceTokenCacheExpirationWindow specify?
We all know the first time that you navigate to a Microsoft SharePoint 2010 site that is secured with SAML claims, it redirects you to get authenticated to ADFS , get your claims. Your SAML identity provider, also known as identity provider security token service (IP-STS), does all that and then redirects you to SharePoint.
The terms you are talking about are related to STS ,which lets you know the STS for your farm.
$sts = Get-SPSecurityTokenServiceConfig
ADFS: The TokenLifetime property can be set at the ADFS end using the command upon creation . Below is example is for 2 sec
Add-ADFSRelyingPartyTrust -Name "abc" -Identifier "https://abc/_trust/" -WsFedEndpoint "https://abc/_trust/" -TokenLifetime 2 -SignatureAlgorithm http://www.w3.org/2000/09/xmldsig#rsa-sha1
STS: The STS config maintains the value of LogonTokenCacheExpirationWindow by default is 10min . $sts.LogonTokenCacheExpirationWindow
WindowsTokenLifetime - LogonTokenCacheExpirationWindow = Concept of Sliding Session
PS http://blogs.msdn.com/b/scicoria/archive/2011/06/10/sharepoint-2010-fba-and-sliding-sessions.aspx
UPDATE: Scenario: Consider you have videos playing in sharepoint which runs for 2hrs . With tokenlifetime(TL) = 30 min and logontokenexpirationwindow(EW) = 10 min , (TL)30-(EW)10 = 20 min . Tokenlifetime(TL) is absolute maximum time that a session remains active should the user become inactive: - On 31st minute the video will get freezed and user needs to re-authenticate. - If you refresh page at 19thmin , new token is not issued but the video will freeze after next 11min and you need to reauthenticate. - If you refresh the page at 23 min , a new token is provided with a fresh window and will continue for next 30min
In order to make sure you have video played for 2 hrs you should change the token value to high and keep expirationwindow to low .
WindowsTokenLifetime: lifetime of tokens issued to logins that use Windows-based login LogonTokenCacheExpirationWindow: minimum lifetime of a token returned from the logon token cache.
As title of both property is telling the story, one is actual setting and 2nd is cache of actual.Tokens which are currently valid, but will be expired after the time specified in the window, will be considered as expired. This is to avoid issues where the token is returned from the cache but expires immediately after and is therefore unusable.
this will explain the situation in more detail:
If you try to log on now, you will likely find that, after you authenticate to AD FS 2.0, you get caught up in an endless loop, going back and forth between SharePoint 2010 and AD FS 2.0. If you look at the traffic in Microsoft Fiddler, you can see that you are authenticating successfully to AD FS 2.0 and then coming back to SharePoint 2010. The authentication code is successfully issuing the FedAuth cookie, and then the authentication code redirects you to /_layouts/authenticate.aspx on the SharePoint site, which clears out the FedAuth cookie and redirects you back to the AD FS site. You go back and forth until AD FS 2.0 stops it and gives you an error message similar to "The same client browser session has made '6' requests in the last '12' seconds". This actually makes sense. This is because the default LogonTokenCacheExpirationWindow value for the SharePoint STS is 10 minutes. In this case, when I created my relying party, I set the token lifetime in AD FS 2.0 to be 2 minutes. Therefore, as soon as the authentication happened, the authentication code logic knew the cookie was good for less time than the LogonTokenCacheExpirationWindow value. The authentication code goes back to AD FS 2.0 to authenticate again. And so it goes, back and forth. To fix this, you just have to change the LogonTokenCacheExpirationWindow value to be less than the SAML TokenLifetime value. Then you can log into the site. The following is example code for setting the LogonTokenCacheExpirationWindow value in SharePoint.
http://msdn.microsoft.com/en-us/library/office/hh147183(v=office.14).aspx
ServiceTokenLifetime: lifetime of a service token when it is first issued ServiceTokenCacheExpirationWindow: minimum lifetime of a token returned from the service token cache
