11

Can I get a good explanation of following terms:

  • WindowsTokenLifetime
  • ServiceTokenLifetime
  • LogonTokenCacheExpirationWindow
  • ServiceTokenCacheExpirationWindow

What does WindowsTokenLifetime minus LogonTokenCacheExpirationWindow specify? Similarly what does ServiceTokenLifetime minus ServiceTokenCacheExpirationWindow specify?

2 Answers 2

7

We all know the first time that you navigate to a Microsoft SharePoint 2010 site that is secured with SAML claims, it redirects you to get authenticated to ADFS , get your claims. Your SAML identity provider, also known as identity provider security token service (IP-STS), does all that and then redirects you to SharePoint.

The terms you are talking about are related to STS ,which lets you know the STS for your farm.

$sts = Get-SPSecurityTokenServiceConfig

ADFS: The TokenLifetime property can be set at the ADFS end using the command upon creation . Below is example is for 2 sec

Add-ADFSRelyingPartyTrust -Name "abc" -Identifier "https://abc/_trust/" -WsFedEndpoint "https://abc/_trust/" -TokenLifetime 2 -SignatureAlgorithm http://www.w3.org/2000/09/xmldsig#rsa-sha1

STS: The STS config maintains the value of LogonTokenCacheExpirationWindow by default is 10min . $sts.LogonTokenCacheExpirationWindow

WindowsTokenLifetime - LogonTokenCacheExpirationWindow = Concept of Sliding Session

PS http://blogs.msdn.com/b/scicoria/archive/2011/06/10/sharepoint-2010-fba-and-sliding-sessions.aspx

UPDATE: Scenario: Consider you have videos playing in sharepoint which runs for 2hrs . With tokenlifetime(TL) = 30 min and logontokenexpirationwindow(EW) = 10 min , (TL)30-(EW)10 = 20 min . Tokenlifetime(TL) is absolute maximum time that a session remains active should the user become inactive: - On 31st minute the video will get freezed and user needs to re-authenticate. - If you refresh page at 19thmin , new token is not issued but the video will freeze after next 11min and you need to reauthenticate. - If you refresh the page at 23 min , a new token is provided with a fresh window and will continue for next 30min

In order to make sure you have video played for 2 hrs you should change the token value to high and keep expirationwindow to low .

6
  • Setting them is not an issue. The question is about the meaning and difference between all these terms. Aug 21, 2014 at 17:17
  • for my future reference i just added few points . I think waqas has all meaning/difference covered .
    – Nikhil J
    Aug 21, 2014 at 17:24
  • See my question about minus thing. If one is set to 30 and other to 10. What does 30 minus 10 which is 20 specify. Also when shud I try to change the servicetokenlifetime from its default value to something else like 30 minutes. Aug 21, 2014 at 17:31
  • blog.petercarson.ca/Pages/… - Tried to explain to my best but check this is too good .
    – Nikhil J
    Aug 21, 2014 at 19:25
  • 1
    Oh, finally I can grasp these terms. Thanks for the best explanation out in the internet. Beats MSDN :) Feb 23, 2015 at 15:42
5

WindowsTokenLifetime: lifetime of tokens issued to logins that use Windows-based login LogonTokenCacheExpirationWindow: minimum lifetime of a token returned from the logon token cache.

As title of both property is telling the story, one is actual setting and 2nd is cache of actual.Tokens which are currently valid, but will be expired after the time specified in the window, will be considered as expired. This is to avoid issues where the token is returned from the cache but expires immediately after and is therefore unusable.

this will explain the situation in more detail:

If you try to log on now, you will likely find that, after you authenticate to AD FS 2.0, you get caught up in an endless loop, going back and forth between SharePoint 2010 and AD FS 2.0. If you look at the traffic in Microsoft Fiddler, you can see that you are authenticating successfully to AD FS 2.0 and then coming back to SharePoint 2010. The authentication code is successfully issuing the FedAuth cookie, and then the authentication code redirects you to /_layouts/authenticate.aspx on the SharePoint site, which clears out the FedAuth cookie and redirects you back to the AD FS site. You go back and forth until AD FS 2.0 stops it and gives you an error message similar to "The same client browser session has made '6' requests in the last '12' seconds". This actually makes sense. This is because the default LogonTokenCacheExpirationWindow value for the SharePoint STS is 10 minutes. In this case, when I created my relying party, I set the token lifetime in AD FS 2.0 to be 2 minutes. Therefore, as soon as the authentication happened, the authentication code logic knew the cookie was good for less time than the LogonTokenCacheExpirationWindow value. The authentication code goes back to AD FS 2.0 to authenticate again. And so it goes, back and forth. To fix this, you just have to change the LogonTokenCacheExpirationWindow value to be less than the SAML TokenLifetime value. Then you can log into the site. The following is example code for setting the LogonTokenCacheExpirationWindow value in SharePoint.

http://msdn.microsoft.com/en-us/library/office/hh147183(v=office.14).aspx

ServiceTokenLifetime: lifetime of a service token when it is first issued ServiceTokenCacheExpirationWindow: minimum lifetime of a token returned from the service token cache

1
  • Have gone through all this before. Unfortunately still not fully clear. Aug 21, 2014 at 16:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.