W.I.F.: Setting IsSessionMode to true, can't seem to make it happen

Question

We are having problems with Safari(and Opera) and from what I have read the FedAuth cookies are just too big.

There is an "neat trick" to fix this: "WIF RTM added a property to the SessionAuthenticationModule, IsSessionMode. When flipped to true, IsSessionMode has the effect of ensuring that the SessionSecurityToken remains in the cache for the whole duration of the session and generating a cookie which contains just a session identifier rather than the content of the session itself."

I have this code in global.asax:

void WSFederationAuthenticationModule_SessionSecurityTokenCreated(object sender, Microsoft.IdentityModel.Web.SessionSecurityTokenCreatedEventArgs e)
{
    FederatedAuthentication.SessionAuthenticationModule.IsSessionMode = true;
}

The Problem , "FederatedAuthentication.SessionAuthenticationModule.IsSessionMode = true" never runs ... why?

---

Is it related to the "PassiveSignInControl" to set IsSessionMode to true?

MSDN Post

your-fedauth-cookies-on-a-diet-issessionmode-true.aspx

From the book "Programming Windows® Identity Foundation":

"An interesting property of the SAM is IsSessionMode. When set to true, IsSessionMode has the effect of storing the bulk of the session on a server-side token cache instead of writing everything in the cookie. The cookie itself will just contain a small context identifier, which will be used for retrieving the session on the server. Unfortunately, in this version of the92 Part II Windows Identity Foundation for Identity Developers product there is no way to set IsSessionMode from the configuration file. You can set it via a property of the PassiveSignInControl, or in the global.asax file as follows(same code as above)"

Answer 1

Old thread, but I believe SessionSecurityTokenCreated is the proper event to handle this--tested it and it works under "old WIF" and NET 4.5 with the appropriate namespace variations.

void WSFederationAuthenticationModule_SessionSecurityTokenCreated(object sender, System.IdentityModel.Services.SessionSecurityTokenCreatedEventArgs e)
{
    e.SessionToken.IsReferenceMode = true;
}

Answer 2

Have you registered your event handler for the SessionSecurityTokenCreated event?

FederatedAuthentication.WSFederationAuthenticationModule.SessionSecurityTokenCreated 
    += this.WSFederationAuthenticationModule_SessionSecurityTokenCreated;

This line needs to be added to the Application_Start medthod in your Global.asax file.

The FederatedAuthentication class in in the namespace Microsoft.IdentityModel.Web.