Beware setting properties or registering events on the SAM and FAM

In WIF some settings or behaviors that you’d want for your application can’t be set in config. Instead these settings or behaviors need to be invoked by either setting properties or handling events on the SAM (SessionAuthenticationModule) or FAM (WSFederationAuthenticationModule). One example is enabling server-side caching of session tokens. This is done by setting the IsReferenceMode property on the SAM:

var sam = FederatedAuthentication.SessionAuthenticationModule;
sam.IsReferenceMode = true;

It seems like you’d simply want to set this globally at application start-up in Application_Start in global.asax, but unfortunately that’s not the right way to do this. The problem with this approach (and this design in WIF) is that in ASP.NET many instances of http modules are created — one for each thread processing http requests in the thread pool. This means we need to set any properties or register for any events per-instance. This then raises the question — where can we do this?

Fortunately in ASP.NET, the Init virtual method is invoked on the application class (meaning, the code you write in global.asax) each time the HttpApplication is created with all of its associated http modules. Here’s the correct place to put the code from above:

protected void Application_Start()
{
    ...
}

public override void Init()
{
    var sam = FederatedAuthentication.SessionAuthenticationModule;
    sam.IsReferenceMode = true;
}

HTH