I have a SharePoint farm that uses an AD FS server as a Trusted Identity Provider.

The AD FS TokenLifetime is set at 30 minutes

The LogonTokenCacheExpirationWindow is set to 1 minute.

According to this: http://blog.robgarrett.com/2013/05/06/sharepoint-authentication-and-session-management/

it would make my sessions last 29 minutes.

the SecurityTokenServiceConfig is set to use a 4 hour cookie lifetime...so the FedAuth cookie looks like it should last 4 hours. However, my users are experiencing timeouts much more frequently.

Is the expiration of the session actually determined by SharePoint and not the cookie? Do I need to kick up the token lifetime in ADFS to let people's sessions last longer?

  • You may find this (msdn.microsoft.com/en-us/library/hh446526.aspx#sec5 ) helpful. Especially the "Token Expiration and Sliding Sessions" section.
    – Amit Tyagi
    Nov 20 '14 at 18:11
  • Did you resolve this? What helped? Can you share? We are having same problem. ADFS token lifetime set to 2 hours. LogonTokenCacheExpiration set to 5 mins. However, users are getting logged out much sooner. It is also inconsistent in that at times they log out in 25 minutes and other time at 1.hour 33 minutes. So there is no consistency in the behavior either.
    – user43691
    Jun 26 '15 at 23:35

Answering your first question - The "Expiration of the session" depends on SAML TokenLifetime and LogonTokenCacheExpirationWindow values. It doesn't depend on the cookie value. The cookie value is just a reference to the actual SAML Token. It is not an indicator of session validity.

Regarding your second question, you may not want to increase the ADFS Token lifetime, if you want your users to login again after every 29 minutes(as per the values provided by you in question).

When you say the users are experiencing timeouts frequently, do you mean less than 29 minutes ?

  • I think to them it feels like shorter than 29 minutes, they'll log in, start to edit a list item then they can't save it because they get forwarded to the login site. changing the TokenLifetime to something much longer in the meantime to see if people continue complaining.
    – Snowburnt
    Nov 20 '14 at 21:16

ADFS: The TokenLifetime property can be set at the ADFS end using the command upon creation . Below is example is for 2 sec . Set this value to a high number ,so that the session never expires while working on page .

Add-ADFSRelyingPartyTrust -Name "abc" -Identifier "https://abc/_trust/" -WsFedEndpoint "https://abc/_trust/" -TokenLifetime 2 -SignatureAlgorithm http://www.w3.org/2000/09/xmldsig#rsa-sha1

STS: The STS config maintains the value of LogonTokenCacheExpirationWindow by default is 10min . $sts.LogonTokenCacheExpirationWindow

WindowsTokenLifetime - LogonTokenCacheExpirationWindow = Concept of Sliding Session

Consider Eg - tokenlifetime(ADFS) = 30 min and logontokenexpirationwindow(EW) = 10 min , (TL)30-(EW)10 = 20 min the session expires . PS http://blogs.msdn.com/b/scicoria/archive/2011/06/10/sharepoint-2010-fba-and-sliding-sessions.aspx

  • 1
    Yes, this information is in the article I posted. How does it relate to my question?
    – Snowburnt
    Nov 20 '14 at 21:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.