We all know the first time that you navigate to a Microsoft SharePoint 2010 site that is secured with SAML claims, it redirects you to get authenticated to ADFS , get your claims. Your SAML identity provider, also known as identity provider security token service (IP-STS), does all that and then redirects you to SharePoint.
The terms you are talking about are related to STS ,which lets you know the STS for your farm.
$sts = Get-SPSecurityTokenServiceConfig
ADFS: The TokenLifetime property can be set at the ADFS end using the command upon creation . Below is example is for 2 sec
Add-ADFSRelyingPartyTrust -Name "abc" -Identifier "https://abc/_trust/" -WsFedEndpoint "https://abc/_trust/" -TokenLifetime 2 -SignatureAlgorithm http://www.w3.org/2000/09/xmldsig#rsa-sha1
STS: The STS config maintains the value of LogonTokenCacheExpirationWindow by default is 10min .
WindowsTokenLifetime - LogonTokenCacheExpirationWindow = Concept of Sliding Session
Scenario: Consider you have videos playing in sharepoint which runs for 2hrs . With tokenlifetime(TL) = 30 min and logontokenexpirationwindow(EW) = 10 min , (TL)30-(EW)10 = 20 min . Tokenlifetime(TL) is absolute maximum time that a session remains active should the user become inactive:
- On 31st minute the video will get freezed and user needs to re-authenticate.
- If you refresh page at 19thmin , new token is not issued but the video will freeze after next 11min and you need to reauthenticate.
- If you refresh the page at 23 min , a new token is provided with a fresh window and will continue for next 30min
In order to make sure you have video played for 2 hrs you should change the token value to high and keep expirationwindow to low .