ID4243: Could not create a SecurityToken. A token was not found in the token cache and no cookie was found in the context.

Question

Thanks to this forum, I feel like I am 70% there to having WIF and ACS working great on my app.  Based on some articles I have read, I decided to enable SessionMode.  I understand in the future I will need to create my own custom cache handler or sync my machine keys to let this work in NLB enviroments.  However for now, during development and ALPHA we will only be on a single front-end.

The problem I am having is that the session token cache is expiring objects before the cookie does.  This of course makes sense given the fact the process ends ever time I restart the IISExpress instance or stop the debugger and rebuild.

It would seem to me that I should be able to hook to an event in the case that this happens and then redirect to ACS for sign-in.  My question is:

• What event can I hook to?  Hopefully something more specific than Application_OnError
• What do I do when I catch the event, do I call WFAM.RedirectToIdentityProvider() - Does anyone have an example of this?

Thank you very much!

Here is the call stack of the error:

[SecurityTokenException: ID4243: Could not create a SecurityToken. A token was not found in the token cache and no cookie was found in the context.]
   Microsoft.IdentityModel.Tokens.SessionSecurityTokenHandler.ReadToken(XmlReader reader, SecurityTokenResolver tokenResolver) +2950
   Microsoft.IdentityModel.Tokens.SessionSecurityTokenHandler.ReadToken(Byte[] token, SecurityTokenResolver tokenResolver) +156
   Microsoft.IdentityModel.Web.SessionAuthenticationModule.ReadSessionTokenFromCookie(Byte[] sessionCookie) +568
   Microsoft.IdentityModel.Web.SessionAuthenticationModule.TryReadSessionTokenFromCookie(SessionSecurityToken& sessionToken) +99
   Microsoft.IdentityModel.Web.SessionAuthenticationModule.OnAuthenticateRequest(Object sender, EventArgs eventArgs) +116
   System.Web.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +148
   System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +75

Answer 1

This is more of a WIF question. You may have better luck on the WIF forums.

Answer 2

Thank you - I posted this question over there.

Answer 3

This problem caused by caching the SessionSecurityToken. The cache destination is in the local domain of application pool so when the .NET needs memory, it automatically will be wiped out. The best solution is two cancel the cacheing for security or implement your own subsystem for caching.

#solution 1
AppFabric for Windows Server
memcached - a distributed memory object caching system

#solution 2


    var sessionSecurityToken = new SessionSecurityToken(principal, TimeSpan.FromHours(Convert.ToInt32(System.Web.Configuration.WebConfigurationManager.AppSettings["SessionSecurityTokenLifeTime"])))
    {
        IsPersistent = false, // Make persistent
        IsReferenceMode = true // Cache on server
    };
    FederatedAuthentication.SessionAuthenticationModule.WriteSessionTokenToCookie(sessionSecurityToken);

---

Best Regards, SeyedMohammadHossein Maybodi