Take the 2-minute tour ×

I have an asp.net app using ADFS as authentication mode. I have relaying party trust for CRM and for this web app. I want to force the user enter the credential when the lifetime of the token has expire, because now, when the lifetime expires, I'm redirect to ADFS and automatically logged in the web app. I would like to change this behaviour just for the web app, leaving the CRM relaying party like there is. Which properties from web.config of the app should I update? Can be this done modifying any property of the relying party trust through PowerShell console?

share|improve this question
Could you rephrase your question. It's not clear to me what you want to achieve –  ccellar Jan 29 '13 at 19:31
I hope now is more clear, thanks for you interest. –  Jorge Jan 30 '13 at 9:37
add comment

3 Answers

Essentially sign-out is just deleting the cookie so:






will work.

Or use the actual method:

var authModule = FederatedAuthentication.WSFederationAuthenticationModule;
        WSFederationAuthenticationModule.FederatedSignOut(new Uri(authModule.Issuer),  new Uri(replyUrl));

Or use the FederatedPassiveSignInStatus (should be in your Toolbox). Set the property SignOutAction to FederatedSignOut and the control will clear out your STS session as well.

share|improve this answer
Sorry for the delay and thank you both for your replies! But wasn't the sign-gout what I was looking for. What I meant was once the TokenLifeTime of the relying party trust expires (the user is this time out of his pc) and try to do any action in the website that is using the relying party trust, I would like them to force to enter his credentials again, because now is happen and automatically logging against ADFS. I would like be like this for have more security in the app. I have tried changing properties in <wsfederation> of web.config, like freshness, but still with the issue. –  Jorge Feb 8 '13 at 10:17
add comment

IMHO your requirement is not possible when CRM and your app are both Relying Parties of the same ADFS-Server/STS. You get Single Sign on by the fact that both use the same service.

You authenticate against ADFS-Server, so there is no notion of logging out of a relying party. You could only log out at of the ADFS-Server, which in turn will have effects on all relying parties.

share|improve this answer
Just to note that this depends on how you logout. If you do the standard application logout, you just logout of the RP. If you do a Federation logout, you logout of both. –  nzpcmad Feb 4 '13 at 18:30
@nzpcmad thanks for the hint. I was not aware of this. Would you mind to add an answer? –  ccellar Feb 5 '13 at 23:58
add comment

In your RP's .config you can set a freshness value to indicate how long the user's credentials should be valid for the STS.

<wsFederation requireHttps="true"
share|improve this answer
add comment

Your Answer


