1

I have SharePoint 2013 on premise with ADFS 3.0 authentication. If a user opens a document from SharePoint, he or she is able to save the document correctly. If that same users does something else and comes back to that document an hour later, he or she gets the error, UPLOAD FAILED: You are required to sign in to upload your changes to this location.

Upload failed

Clicking the Sign In button typically does nothing but occasionally brings up the Authentication selector dropdown (Authenticate.aspx) in a modal window. In the few times that page comes up, selecting ADFS will authenticate the user and the document is saved. I have no idea why this comes up sometimes and other times does nothing.

Signin Dropdown

I suspect this issue has to do with token lifetime but I'm not sure. I set the timeout in ADFS for my Relying Trust to be 10 hours via the following PowerShell ran on the ADFS server:

Set-ADFSRelyingPartyTrust -Targetname "My_SharePoint_relying_party" -TokenLifetime 600

I then updated my Security Token Service in SharePoint via the following:

$sts = Get-SPSecurityTokenServiceConfig
$sts.CookieLifetime = New-TimeSpan -Minutes 600
$sts.WindowsTokenLifetime = New-TimeSpan -Minutes 600
$sts.MaxApplicationTokenCacheItems = 100000
$sts.MaxLogonTokenCacheItems = 100000
$sts.MaxServiceTokenCacheItems = 100000
$sts.Update()

It now resembles the following:

SharePoint STS

Is there anything else I need to do to increase the authentication token lifetime for saving SharePoint documents from Office?

Improve this question
5

2 Answers 2

Reset to default
2

Looks like it just took a while for my changes to become active. The problem is gone now. I suspect one of the following resolved my issue but I'm not sure.

$sts.MaxApplicationTokenCacheItems = 100000
$sts.MaxLogonTokenCacheItems = 100000
$sts.MaxServiceTokenCacheItems = 100000

Set-ADFSRelyingPartyTrust -Targetname "My_SharePoint_relying_party" -TokenLifetime 600
Improve this answer
1
  • 2
    $sts.MaxLogonTokenCacheItems is the one. It is the maximum number of user login tokens that can be cached on a server. The default value is 250, meaning once user 251 logs in, user 1's token gets expired no matter what the lifetime setting is on that server because it's token cache is full. In theory, this value should be at or higher than your expected user count. I go with double my expected user count. You could probably get away with setting it to your total users too, since they aren't likely to all be logged in at once.
    – DubStep
    May 2, 2018 at 18:25
0

I did not try all this process of token life time as I am not sure if our company use ADFS. We just have office365...

What fix my problem is: I went in to the settings; Access work or school; Disconnect.

To ensure to have all chances in my site, I also cleared the DNS cache - I read some issues were related to that.

cmd: ipconfig /flushdns

Then I restarted the computer.

Went back to work or school (on settings) and connected again. (There was a message that my system is already registered) I click OK (if required - I don't remember). Then everything was fine. This fixes also the message Registering the device a server error occured. please try again. (0x80180018).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.