Configuring machine key protection of session tokens in WIF and Thinktecture IdentityModel

Session tokens in WIF, by default, are protected with DPAPI which auto-generates a key that is specific to the machine. This means, by default, that session tokens won’t work in a web farm. Session tokens can be configured to use the ASP.NET <machineKey> for protection instead. This is achieved by using the MachineKeySessionSecurityTokenHandler as the session security token handler configured in web.config:

<system.identityModel>
  <identityConfiguration>

    <securityTokenHandlers>
      <remove type="System.IdentityModel.Tokens.SessionSecurityTokenHandler,
                    System.IdentityModel, Version=4.0.0.0, Culture=neutral,
                    PublicKeyToken=B77A5C561934E089" />

      <add
        type="System.IdentityModel.Services.Tokens.MachineKeySessionSecurityTokenHandler,
              System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral,
              PublicKeyToken=B77A5C561934E089">
        <sessionTokenRequirement lifetime="00:30:00"></sessionTokenRequirement>
      </add>
    </securityTokenHandlers>

  </identityConfiguration>
</system.identityModel>

Notice this is configured similarly as described here when setting the session security token duration. Also notice that the MachineKeySessionSecurityTokenHandler supports the same configuration with the <sessionTokenRequirement> element and lifetime attribute.

Just as with the normal session security token handler, in Thinktecture IdentityModel a ConfigureMackineKeyProtectionForSessionTokens API was developed to allow this configuration be performed in code from Application_Start in global.asax:

protected void Application_Start()
{
    PassiveSessionConfiguration.ConfigureMackineKeyProtectionForSessionTokens();
}

This API will trigger the use of the machine key session security token handler and it will use the same session token lifetime as configured with the ConfigureDefaultSessionDuration API described here.