When creating a Security Token Service (STS) for a claims based security model, it seems appropriate that tokens are generated in such a way that they expire after some duration, as suggested here. Around this concept, I have a few specific questions, but am looking for any feedback regarding best practices in this area.
- What are recommended values for the timeout length and/or what should be taken into consideration when determining this?
- If a user is active for longer than the typical expiration period, how should this be handled such that the user is no required to re-authenticate in the middle of their session?
- Is there an elegant way to design a service to perform batch actions "on behalf of" another user by utilizing the token? i.e. Utilizing the token at a later time may have caused it to expire.