MVC WebAPI active authentication

Question

I'm writing multiple client apps (iPhone/android/windows phone) that are going to call into an Azure ACS secured mvc webapi controller (sorry for the acronym soup).

Securing the webapi is straight forward with WIF (well, .net 4.5), and I can passively log in without issue.

I have also created a POC iPhone application that uses a web browser to get the user to authenticate against the azure AD IP, then using the guide here I can get a javascript token.

Now I guess the next step is to use the JSON Web Token Handler on the web controller and I should be able to pull the data fine.

However how long can I store the token for? Should I try the webapi endpoint, and if it's rejected get the user to re-authenticate, or is there anyway to set the token so it either never expires, or it expires after months?

Thanks

Ross

Answer 1

AFAIK, ACS limits the lifetime of a JWT token to 24 hours (This is not a JWT constraint- it is an ACS one); after that you have to renew it. Storing a security token for a long time is in general not a good idea since the user may be deactivated or her claims might have changed. You can know when a token expires by looking at the "exp" member of the security token. The security token you will receive from ACS is BASE64 encoded. If has 2 to 3 parts separated by a dot. If you decode the token, then the second part of the token will give you the "exp" member. Microsoft has provided toolkits for ios at https://github.com/WindowsAzure-Toolkits/wa-toolkit-ios. (toolkits for android etc also exist).