title: How to avoid 'SamlAssertion.NotOnOrAfter condition is not satisfied' errors
body: <p>Recently I have started using claim-based authentication on an existing web application. Because the application makes use of jQuery &amp; more notably, the AJAX functions, I have had to alter the handlers not to attempt to redirect the <code>XmlHTTPRequests</code>, and instead return a 403 status which is easier to handle.</p>
  
  <p>Here is the <code>FederatedAuthentication.WSFederationAuthenticationModule.AuthorizationFailed</code> event hanlder:</p>
  
  <pre><code>    protected void WSFederationAuthenticationModule_AuthorizationFailed(object sender, AuthorizationFailedEventArgs e)
      {
          //WSFederationAuthenticationModule sam = (WSFederationAuthenticationModule)sender;
  
          HttpContext context = HttpContext.Current;
          HttpRequest req = context.Request;
          HttpResponse resp = context.Response;
  
          if (req == null || resp == null) return;
  
          if ((resp.StatusCode == 302 || resp.StatusCode == 401) &amp;&amp; req.Headers["X-Requested-With"] == "XMLHttpRequest")
          {
              resp.StatusCode = 403;
              e.RedirectToIdentityProvider = false;
          }
  
      }
  </code></pre>
  
  <p>I have the following pattern that implements the AJAX calls and handle the response:</p>
  
  <pre><code>$.ajax({
  cache: false,
  data: $.param(o),
  dataType: "xml",
  url: "AJAXCall.ashx",
  success: function (data)
  {
      // Success handler
  },
  error: function (XMLHttpRequest, textStatus, responseText)
  {
      if (XMLHttpRequest.status == 403)
      {
          var retVal = window.showModalDialog("Session.aspx", "", "dialogHeight: 250px; dialogWidth: 250px; edge: Raised; center: Yes; resizable: Yes; status: Yes;");
          if (retVal)
          {
              // Succesful session renewal handler
          }
          else
          {
              // Session renewal failure handler
          }
      }
      else
      {
          // Other errors handler
      }
  }
  });
  </code></pre>
  
  <p>The 'Session.aspx' basically closes the modal dialog with a return value of true if it successfully redirected to the Identity Provider and back.</p>
  
  <p>But my problem is that I get the following error:</p>
  
  <blockquote>
    <p><em>"ID4223: The SamlSecurityToken is rejected because the
    SamlAssertion.NotOnOrAfter condition is not satisfied."</em></p>
  </blockquote>
  
  <p>This is invoked on a subsystem that impersonates the current application user and obviously the token of the previous session still persist. I have the following setting in my application's web.config:</p>
  
  <pre><code>&lt;federatedAuthentication&gt;
  &lt;wsFederation passiveRedirectEnabled="true" persistentCookiesOnPassiveRedirects="true" issuer="https://adfs.example.com/adfs/ls/" realm="https://www.example.com:449/" requireHttps="true" /&gt;
  &lt;cookieHandler requireSsl="true" /&gt;
  </code></pre>
  
  <p></p>
  
  <p>How do I avoid this error? Any help will be greatly appreciated.</p>