如何在自定义策略中配置Session Behavior与Token Lifetimes

Great question—custom policies give you granular control over your authentication flows, but getting session and token settings right can feel a bit overwhelming at first. Let’s break down both of your questions with concrete examples and explanations:

1. Configuring Session Behavior #

Session behavior controls how long a user stays authenticated without re-entering credentials, and how their session is managed across applications. You’ll adjust these settings within the <UserJourneyBehaviors> element of your custom policy.

• Set session duration and type
  You can choose between two session expiry modes:

  • Rolling: Extends the session expiry every time the user interacts with the application (ideal for apps where users stay active for long periods)
  • Absolute: Forces re-authentication after a fixed time, regardless of user activity (better for high-security scenarios)

  Here’s a sample configuration:

  <UserJourneyBehaviors>
    <!-- Single sign-on settings -->
    <SingleSignOn Scope="Tenant" SessionExpiryType="Rolling" SessionExpiryInSeconds="1800" />
    <!-- Fallback absolute expiry if rolling isn't used -->
    <SessionExpiryType>Absolute</SessionExpiryType>
    <SessionExpiryInSeconds>3600</SessionExpiryInSeconds>
  </UserJourneyBehaviors>
  

  The Scope parameter determines if the session is shared across all apps in your tenant (Tenant) or restricted to a single application (Application).

• Manage session revocation
  To control how sessions are invalidated (e.g., when a user logs out), add a <SessionManagement> element to your relying party policy. This ensures that the session is properly revoked across all contexts:

  <RelyingParty>
    <DefaultUserJourney ReferenceId="SignUpOrSignIn" />
    <UserJourneyBehaviors>
      <SessionManagement ReferenceId="SM-AAD" />
    </UserJourneyBehaviors>
  </RelyingParty>
  

  The SM-AAD reference links to a pre-defined session management technical profile that handles Azure AD session revocation.

2. Configuring Token Lifetimes #

Token lifetimes dictate how long access, ID, and refresh tokens remain valid. These settings are adjusted in the JwtIssuer technical profile of your policy.

• Access Tokens
  Control how long the access token (used to access protected resources) is valid by setting AccessTokenLifetime in the metadata:

  <TechnicalProfile Id="JwtIssuer">
    <Metadata>
      <!-- Set access token to expire after 1 hour -->
      <Item Key="AccessTokenLifetime">3600</Item>
    </Metadata>
  </TechnicalProfile>
  

• ID Tokens
  ID tokens (used for authentication) have their own lifetime setting with IdTokenLifetime:

  <TechnicalProfile Id="JwtIssuer">
    <Metadata>
      <!-- Set ID token to expire after 10 minutes -->
      <Item Key="IdTokenLifetime">600</Item>
    </Metadata>
  </TechnicalProfile>
  

• Refresh Tokens
  Refresh tokens let users obtain new access tokens without re-authenticating. You can configure three key settings:

  • RefreshTokenLifetime: Maximum absolute lifetime of the refresh token
  • SlidingRefreshTokenLifetime: If set, the refresh token’s expiry is extended each time it’s used (up to the absolute lifetime)
  • RefreshTokenUsage: Choose Reuse to allow multiple uses, or OneTime to invalidate the token after a single use

  Example configuration:

  <TechnicalProfile Id="JwtIssuer">
    <Metadata>
      <!-- Refresh token valid for 14 days total -->
      <Item Key="RefreshTokenLifetime">1209600</Item>
      <!-- Extend expiry by 5 days each time it's used -->
      <Item Key="SlidingRefreshTokenLifetime">432000</Item>
      <!-- Allow reusing the same refresh token -->
      <Item Key="RefreshTokenUsage">Reuse</Item>
    </Metadata>
  </TechnicalProfile>
  

A quick pro tip: Always test these settings in a non-production environment first—small changes can have big impacts on both user experience and security.

内容的提问来源于stack exchange，提问作者spottedmahn