FedAuth cookie expiration ADFS in SharePoint 2010

Question

I have the follow situation: TokenLifetime on ADFS STS  for SharePoint setted for 10 hours and the LogonTokenCacheExpirationWindow  on SharePoint setted to 1 minute.
But I see from time to time that after 2 hour user may be redirected to ADFS STS. We have NLB on our solution, may be SPTokenCache not adopted to work with NLB? The Affinity on the NLB Servers is set with single. We have users
randomly be redirected back to a login page. We make use of Persistent cookies.
Sometimes the users end up in an authentication loop that causes ADFS to halt the request because of a perceived denial of service (DOS) attack, as the note states.
If i look at a trace of the activity, i see SharePoint setting the fedauth cookie has an expired value, and start making the requests again to ADFS, which then, for reasons which are still unclear to me, either won’t issue
you a non-expired cookie, or SharePoint looks at and transforms it to an expired cookie.  That’s what kicks off that DOS cycle I described above. 
I don't get it because i USE SINGLE AFFINITY WITH WINDOWS LOAD BALANCER! Please help :(
jtjscholten

Answer 1

Hi  jtjscholten,
Before sending a new FEDAUTH cookie back to the user’s browser, SharePoint calculates the expiration of the cookie with the following formula:
SAML Token Lifetime – Logon Token Cache Expiration Window
For example, if ADFS sets the SAML Token Lifetime to 10 minutes and Logon Token Cache Expiration Window is set in the STS as 2 minutes then the overall SharePoint session lifespan is 8 minutes.
And if (TokenLifeTime - LogonTokenCacheExpirationWindow) =< 0 then you get a loop.
For your issue, please take steps as below:
Try below command on ADFS server:
Add-PSSnapin Microsoft.ADFS.PowerShell
Set-AdfsRelyingPartyTrust –TargetName "[ourrelayingpartytrustreference]" –TokenLifeTime 10
Stop and start the ADFS server(do not restart it. Manually stop and start it)
Then run below command on sharepoint server
$sts = Get-SPSecurityTokenServiceConfig
$sts.LogonTokenCacheExpirationWindow = (New-Timespan -Minutes 1)
$sts.Update()
iisreset
Reference:
http://social.technet.microsoft.com/Forums/en-US/f8d0fa27-2044-47c1-8dbd-0cf6dfb49942/fedauth-cookie-intermittently-set-as-persistent-cookie?forum=sharepointadmin
http://msdn.microsoft.com/en-us/library/hh147183.aspx
http://technet.microsoft.com/en-us/library/jj219795(v=office.15).aspx
Best Regards,
Eric
Eric Tao
TechNet Community Support