How to correctly refresh SAML token without user interaction, i.e. re-login?

user_6329430 0
Viewed 751

There is a spring boot application, which has SP-initiated SSO flow, with Azure AD as IDP. In Azure AD SAML token's default lifetime is set to one hour (NotOnOrAfter in <conditions>).

So, the authentication itself works fine, unless SAML assertion expires (after one hour no matter idle or active session). In this case app returns 401 and redirects user to the login page. But I understand that it's not correct to ask user to re-login every hour.

I have tried IsPassive + ForceAuthn, and this solution seemed promising for me, but unfortunately didn't work. AzureAD returns me following: AADSTS50058: A silent sign-in request was sent but no user is signed in.

Is there any way to keep user signed on without any further user interactions and redirects to the login page? For example for 24 hours, but without changing SAML assertion lifetime on IDP side. Or this is the way how SAML works and user MUST go through re-login every single time when assertion expires?

azure-active-directory spring-security saml single-sign-on active-directory
1 Answers

If you are using the Implicit flow then this does not support the refresh token. However you can request for token silently.

This code helps you to renew the token manually by passing only the clientId as your scope to acquireTokenSilent.

You can read about refreshing the token here.

user_145924310
Related