ADFS freshness and session sliding

问题

I have implemented session sliding using in my customehttphandler module.

I am trying to acheive session sliding as well as getting authenticated on multiple website which share same ADFS server.

 public void SessionAuthenticationModuleSessionSecurityTokenReceived(object sender, SessionSecurityTokenReceivedEventArgs e)
        {
            SessionSecurityToken token = e.SessionToken;
            DateTime nowUtc = DateTime.UtcNow;
            DateTime validFrom = token.ValidFrom;
            DateTime validTo = token.ValidTo;
            double totalMinutes = (validTo - validFrom).TotalMinutes;
            double halfSpan = totalMinutes / 2;

            SessionAuthenticationModule sam = sender as SessionAuthenticationModule;

            if (validTo < nowUtc)
            {
                if (sam != null)
                {
                    sam.DeleteSessionTokenCookie();
                    e.Cancel = true;
                }               
            }
            else if ((nowUtc - validFrom).TotalMinutes >= halfSpan)
            {
                SessionSecurityToken renewToken =             sam.CreateSessionSecurityToken(
                    token.ClaimsPrincipal,
                    token.Context,
                    nowUtc,
                    nowUtc.AddMinutes(totalMinutes),
                    true);
                e.SessionToken = renewToken;

                e.ReissueCookie = true;

//db timestamp update
            }
        }

And SignedIn event

 public void WSFederationAuthenticationModuleSignedIn(object sender, EventArgs e)
        {

             token = gettoken from cookie
            if (token.ValidTo > DateTime.Now.ToUniversalTime())
            {
                     //db insert for new login (assuming this will fire only      once on actual login)
                   reissue token
            }
       }

Session timeout is mentioned in the my relying party application web config

<securityTokenHandlers>
        <add type="Microsoft.IdentityModel.Tokens.SessionSecurityTokenHandler, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35">
          <sessionTokenRequirement lifetime="0:02" />
        </add>
      </securityTokenHandlers>

Token Life time on ADFS I do not want to change which is greater than 2 minutes.

But issue is, after 2 minutes time out is not happening. It goes to SingedIn event becuase i assume it reissue token and then it calls session token received event so this condition (if (validTo < nowUtc)) never satisfy, how can i achieve timeout here? Freshness="0"achieves it but If i set Freshness="0" then I can not get authenticated by other website which are on same ADFS server. I want to be authenticated on other website as well if i have logged in one.

If I remove freshness="0" I can be authenticated without login on second website which is different application.

Why SignedIn is getting called before session token received and How can i achieve timeout in proper way and get authenticated in multiple website?

Note: I have these events in my customeHttpHanlder module. which has other event as well like PostAuthenticateRequest.

回答1:

when you receive a session token, the token you receive from adfs starts expiring. After it has been completely expired it needs to be refreshed.

• This is a balance between having acurate information from adfs (calling into ad each time you want to know something about the user) and having a workable situation (a signed token has a certain validity in which we trust the information to remain valid).

After the token expires, you need to get back to adfs (hence the signin event) to get a new token from adfs. The idea is that some of the information might have changed between the issuing of these two tokens.

You can implement sliding sessions on the client side (your relying parties) but that makes little sense (I'll come back to this) since you are telling yourself that the token is valid for another period. You trust yourself but the information inside the token can get out of sync and that is why you always need to go back to adfs.

All of this could make sense if you implement an automatic refresh of the token yourself. This would mean that you exchange your current token for a new one with a new validity period. I guess adfs can do this (but you need the active scenario for this). It's not a lot of code but it can be hell to setup right and I don't have any example for this.

In the end you need to ask yourself if it's worth the hassle. WIF will do an automatic signin again and a user inside the domain will be automatically logged in. A user outside the domain might have to type here credentials again. I don't think this is the end of the world.

• Finally, I see you use Microsoft.IdentityModel.Tokens.SessionSecurityTokenHandler which is the old implementation. .Net 4.5 has a newer implementation..

来源：https://stackoverflow.com/questions/30007507/adfs-freshness-and-session-sliding