Configuring session token lifetime in WIF with the session authentication module (SAM) and Thinktecture IdentityModel

For browser-based (passive) applications when federating, session token lifetime in WIF (by default) is controlled by one of two factors: 1) original token lifetime from the STS, or 2) the configured session token lifetime for the RP (in the session security token handler). The resultant session token lifetime is the shorter of the two values. The configured session token lifetime for the RP is configurable in web.config:

<system.identityModel>
  <identityConfiguration>

    <securityTokenHandlers>
      <remove type="System.IdentityModel.Tokens.SessionSecurityTokenHandler,
                    System.IdentityModel, Version=4.0.0.0, Culture=neutral,
                    PublicKeyToken=B77A5C561934E089" />

      <add type="System.IdentityModel.Tokens.SessionSecurityTokenHandler,
                 System.IdentityModel, Version=4.0.0.0, Culture=neutral,
                 PublicKeyToken=B77A5C561934E089">
        <sessionTokenRequirement lifetime="00:30:00"></sessionTokenRequirement>
      </add>

  </identityConfiguration>
</system.identityModel>

Notice the approach involves un-registering the session security token handler and then re-registering it with a <sessionTokenRequirement> element with a lifetime attribute. While this approach is possible, it’s tedious, so in Thinktecture IdentityModel there is now a ConfigureDefaultSessionDuration API on the PassiveSessionConfiguration class to allow this configuration from code:

protected void Application_Start()
{
    var duration = TimeSpan.FromMinutes(30);
    PassiveSessionConfiguration.ConfigureDefaultSessionDuration(duration);
}

The code based approach is slightly more convenient, with the tradeoff that the duration is embedded in the code.