We have our token to expire after 10 hours, but every 4-5 minutes SharePoint goes out and re-authenticates against the token. Browser activity doesn't matter. How do we keep SharePoint from re-authenticating against the token? I feel like this has something to do with the FedAuth cookie, but not sure.
5
- check from AD server what is Web SSO Lifetime value, can you run this Get-ADFSProperties on AD server? also on sharepoint server run this Get-SPSecurityTokenServiceConfig and share the output...Waqas Sarwar MVP– Waqas Sarwar MVP ♦2014-10-23 19:50:12 +00:00Commented Oct 23, 2014 at 19:50
- Which variables do you want to see?mp42871– mp428712014-10-23 20:53:34 +00:00Commented Oct 23, 2014 at 20:53
- web lifetoken from adfs and logontokencacheWaqas Sarwar MVP– Waqas Sarwar MVP ♦2014-10-23 20:57:01 +00:00Commented Oct 23, 2014 at 20:57
- Okay. I won't be able to get those until probably Monday. Am I wrong in thinking that its probably a SharePoint setting issues since other apps use that same token and they don't have timeout issues?mp42871– mp428712014-10-23 22:04:45 +00:00Commented Oct 23, 2014 at 22:04
- screenshot of get-spsecuritytokenserviceconfigmp42871– mp428712014-10-24 01:23:45 +00:00Commented Oct 24, 2014 at 1:23
Add a comment |
4 Answers
Enable STS Session Cookie
$sts = Get-SPSecurityTokenServiceConfig $sts.UseSessionCookies = $true $sts.Update() LogonTokenCacheExpirationWindow for the SharePoint STS is 10 minutes. The relying party by default it sets the token lifetime in ADFS to be 2 minutes.
LogonTokenCacheExpirationWindow in SharePoint
$sts = Get-SPSecurityTokenServiceConfig $sts.LogonTokenCacheExpirationWindow = (New-TimeSpan –minutes 1) $sts.Update() Then do an IISRESET
- What does enabling the STS session cookie do? Currently it is disabled.mp42871– mp428712014-10-23 18:59:29 +00:00Commented Oct 23, 2014 at 18:59
- I was giving you hints which you can try. msdn.microsoft.com/en-us/library/office/…Amal Hashim– Amal Hashim2014-10-23 19:02:20 +00:00Commented Oct 23, 2014 at 19:02
- I don't want to use session cookies because it breaks office integration.mp42871– mp428712014-10-23 20:53:17 +00:00Commented Oct 23, 2014 at 20:53
- Then you can change the
LogonTokenCacheExpirationWindowAmal Hashim– Amal Hashim2014-10-23 21:00:57 +00:00Commented Oct 23, 2014 at 21:00 - This is already set to 10 minutes but its timing out way before thatmp42871– mp428712014-10-23 22:05:55 +00:00Commented Oct 23, 2014 at 22:05
Set the ADFS value to high number like 10 hrs and set the sharepoint token expiration cache to lower value 20min(not 10 hrs) .
- The windowstokenlifetime is set to 10 hours and the LogonTokenCacheExpirationWindow is set to 10 minutesmp42871– mp428712014-10-24 01:11:06 +00:00Commented Oct 24, 2014 at 1:11
- screenshot of get-spsecuritytokenserviceconfigmp42871– mp428712014-10-24 01:26:04 +00:00Commented Oct 24, 2014 at 1:26
- The adfs value should be less . u have to do it on adfs serverNikhil J– Nikhil J2014-10-24 03:27:26 +00:00Commented Oct 24, 2014 at 3:27
- OK, which value is the adfs value?mp42871– mp428712014-10-24 10:35:49 +00:00Commented Oct 24, 2014 at 10:35
Don't know how helpful it will be, but we were also suffering from the same issue. Turns out it had nothing to do with the cache or token at all, but instead had to do with how many users could be cached per web front end. The default for SP 2013 is only 250 users, so as soon as user 251 logs in, it invalidates the cache for user 1. Then user 252 invalidates 2 and so on. In any decent sized organization this can lead to a round-robin of invalidation. We fixed with the following PowerShell script.
$maxTokens = 5000 $sts = Get-SPSecurityTokenServiceConfig $sts.MaxServiceTokenCacheItems = $maxTokens $sts.MaxLogonTokenCacheItems = $maxTokens $sts.Update() iisreset 
Have you seen this?
SharePoint calculates the expiration of the cookie with the following formula:
SAML Token Lifetime – Logon Token Cache Expiration Window
This forum post suggests to do this:
Run this command on ADFS, then start/stop ADFS after this is ran (not restart) (looks like this is already set correctly based on your screenshot in one of the comments above)
Add-PSSnapin Microsoft.ADFS.PowerShell Set-AdfsRelyingPartyTrust –TargetName "[ourrelayingpartytrustreference]" –TokenLifeTime 10 Run on sharepoint server:
$sts = Get-SPSecurityTokenServiceConfig $sts.LogonTokenCacheExpirationWindow = (New-Timespan -Minutes 500) $sts.Update() iisreset (I set it to 500 min here, but set it to however long you want it to be)
Did you try this yet? Hope this helps... sorry if it's just noise.
