STS logging user out after 60 mins, how to extend?

0
votes

I have setup a Relying Party, SharePoint site and a Claims application. My application's are talking to each other and the SSO is working with SharePoint. My only issue now is that after about an hour, the user is logged out of the application and sent to the STS login. I can't seem to pinpoint what needs to be changed to extend the users "session." I realize it could possibly be a cookie and not a session. Anybody have any pointers? I spent some time looking around on the web, but haven't been able to pin point a solution to this issue.

I have done all of the following to IIS to extend the timeout but to no avail:

  1. Change the Application Pools idle time-out.
  2. Change the ASP Session time-out value by going to ASP – Session Properties under IIS manager.
  3. Change Cookie Settings time-out value by going to Session State ->Cookie Settings

federatedAuthentication of RP:

<federatedAuthentication>
    <wsFederation passiveRedirectEnabled="true" issuer="mystsapplication" realm="RelyingPartURL" requireHttps="false" />
    <cookieHandler requireSsl="false" path="/" name="MyCookieHandler" persistentSessionLifetime="0:10:0" />
  </federatedAuthentication>

This is also in the web.config of my RP:

web.config of STS application:

 authentication mode="Forms">
    <forms loginUrl="Login.aspx" protection="All" timeout="600" name=".ASPXAUTH" path="/" requireSSL="false" slidingExpiration="true" defaultUrl="default.aspx" cookieless="UseDeviceProfile" enableCrossAppRedirects="false" />
</authentication>
1
.netiiswifclaims-based-identity

1 Answers

0
votes

By default, WIF will use the shorter of either the duration indicated in the token or the duration indicated in your local config. You can decide to use some other timeout if you wish. Here's a helper I put together to assist with that:

http://brockallen.com/2013/02/17/overriding-ws-federation-token-lifetime-in-thinktecture-identitymodel/

and

http://brockallen.com/2013/02/17/sliding-sessions-in-wif-with-the-session-authentication-module-sam-and-thinktecture-identitymodel/