SAML assertion expiry causes asset lifecycle session drops after 30 minutes

PLM Teamcenter
, , , , , , ,
1

Users working on asset lifecycle management tasks are being logged out after exactly 30 minutes, even when actively working. They have to re-authenticate through SSO, which disrupts their workflow significantly.

The pattern is consistent-users log in via SAML SSO, start working on asset phase transitions or maintenance schedules, and after 30 minutes they’re suddenly logged out mid-task. Any unsaved work is lost. Our IdP is configured with a 4-hour session timeout, and the Teamcenter session timeout is set to 8 hours, so neither should be causing this.

We suspect the SAML assertion lifetime is the culprit, but we’re not sure how to configure it properly for long-running asset lifecycle operations. Some of our maintenance planning sessions can take hours, and constant re-authentication is making the system unusable. The issue affects asset lifecycle specifically-other modules don’t seem to have the same problem. Has anyone dealt with SAML assertion expiry impacting session persistence in asset management workflows?

system 2

The session drop issue you’re experiencing is caused by a mismatch between SAML assertion lifetime, IdP session lifetime, and Teamcenter session persistence. Here’s how to properly configure each component:

1. SAML Assertion Lifetime Configuration

Your IdP is issuing SAML assertions with a 30-minute validity period (NotOnOrAfter attribute). This is independent of the IdP session timeout. To extend assertion lifetime:

In your IdP configuration (example for Shibboleth):

<bean id="shibboleth.DefaultAssertionLifetime"
      class="java.lang.Long">
    <constructor-arg value="14400000" /> <!-- 4 hours in milliseconds -->
</bean>

For other IdPs:

  • Okta: Admin Console → Applications → Teamcenter → Sign On → Advanced Settings → Assertion Lifetime = 240 minutes
  • Azure AD: Enterprise Applications → Teamcenter → Single Sign-On → SAML Token Lifetime = 240 minutes
  • ADFS: Relying Party Trust → Edit Claim Rules → Issuance Transform Rules → Modify assertion lifetime

However, extending assertion lifetime beyond 2 hours raises security concerns. A compromised assertion remains valid for the entire period.

2. IdP Session Configuration and Refresh

The better approach is implementing silent assertion refresh. Configure your IdP to support passive authentication requests:

IdP configuration for passive refresh:

<bean id="shibboleth.PassiveAuthenticationSupported"
      class="java.lang.Boolean">
    <constructor-arg value="true" />
</bean>

This allows Teamcenter to request new assertions without user interaction.

3. Session Persistence in Teamcenter

Configure Teamcenter to implement assertion refresh before expiry. Update your SAML authentication configuration:

In tc_profilevars.sh or site.xconf:


export SAML_ASSERTION_REFRESH_ENABLED=true
export SAML_ASSERTION_REFRESH_THRESHOLD=300  # Refresh 5 min before expiry
export TC_SESSION_TIMEOUT=28800  # 8 hours
export TC_SESSION_PERSISTENCE_ENABLED=true

Configure the SAML authentication filter to trigger refresh:


wt.auth.saml.assertionRefresh.enabled=true
wt.auth.saml.assertionRefresh.threshold=300
wt.auth.saml.assertionRefresh.method=passive
wt.auth.saml.sessionPersistence.enabled=true
wt.auth.saml.sessionPersistence.timeout=28800

Asset Lifecycle Specific Configuration:

Asset lifecycle operations require special handling because they maintain transactional state:


wt.lifecycle.session.preserveOnAuthRefresh=true
wt.lifecycle.transaction.timeout=14400
wt.lifecycle.session.assertionValidation=relaxed

The relaxed validation mode allows the lifecycle session to continue even if assertion refresh temporarily fails, preventing data loss during network hiccups.

Implementation Strategy:

  1. Short-term fix (immediate relief): Extend assertion lifetime to 2 hours at IdP
  2. Medium-term (within 2 weeks): Implement silent assertion refresh in Teamcenter
  3. Long-term (best practice): Configure session persistence with automatic refresh

Silent Refresh Implementation:

Add a JavaScript module to the asset lifecycle UI that monitors assertion expiry:

// Pseudocode - Key implementation steps:
1. Parse SAML assertion from session cookie
2. Extract NotOnOrAfter timestamp
3. Calculate time remaining until expiry
4. If < 5 minutes, trigger passive authentication:
   - Create hidden iframe
   - Set src to IdP passive auth endpoint
   - Include IsPassive=true parameter
5. On successful refresh, update session with new assertion
6. On failure, show warning dialog before logout

Validation and Testing:

  1. Monitor SAML assertions in browser developer tools
  2. Verify assertion refresh occurs before expiry
  3. Test with long-running asset lifecycle operations (2+ hours)
  4. Check Teamcenter logs for assertion validation messages
  5. Verify no session drops during active work

Security Considerations:

  • Longer assertion lifetime = larger attack window if compromised
  • Silent refresh requires passive authentication support at IdP
  • Session persistence must be protected with secure cookies
  • Consider implementing re-authentication for sensitive operations even with valid sessions

Monitoring:

Implement logging to track assertion refresh events:


wt.auth.saml.logging.assertionRefresh=INFO
wt.auth.saml.logging.sessionPersistence=INFO

This logs all refresh attempts, successes, and failures, helping you identify any ongoing issues.

After implementing these configurations, users should be able to work on asset lifecycle tasks for the full session timeout period (8 hours) without interruption. The combination of reasonable assertion lifetime (2 hours), silent refresh (before expiry), and session persistence (beyond assertion lifetime) provides both security and usability. Test thoroughly with actual asset lifecycle workflows before deploying to production.

This draft is based on general Teamcenter knowledge. It has not been verified against your specific version and environment. Practitioners: verify the steps and share your experience below.

3

The 30-minute timeout is almost certainly the default SAML assertion lifetime. SAML assertions are different from session tokens-they’re time-limited proof of authentication. Your IdP issues an assertion when the user logs in, and Teamcenter validates it. If the assertion expires but the session is still active, you get this exact behavior. You need to either extend the assertion lifetime in your IdP configuration or implement assertion refresh logic in Teamcenter.

4

Check your IdP’s SAML assertion settings. Most IdPs have separate configurations for session lifetime versus assertion lifetime. The assertion lifetime is typically much shorter for security reasons. For long-running applications like asset lifecycle management, you need to configure assertion refresh or use a longer assertion lifetime with appropriate security controls.

6

This is a common issue with SAML-based authentication in long-running enterprise applications. The problem is that Teamcenter’s asset lifecycle module maintains server-side state for ongoing operations, but the SAML assertion that authenticated the session expires independently. You have three options: increase assertion lifetime at the IdP, implement silent assertion refresh using hidden iframes, or configure Teamcenter to cache authentication credentials beyond the assertion lifetime. The third option is the most complex but provides the best user experience. You’ll need to balance security requirements with usability-longer assertion lifetimes reduce security, while silent refresh can be blocked by browser security policies.

8

We had this exact issue. The solution was implementing a token refresh mechanism. Configure your SP to request a new assertion before the current one expires. Most modern IdPs support this through the AuthnRequest protocol.

9

Asset lifecycle operations are particularly sensitive to this because they involve multi-step workflows that can span hours. A user might start a phase transition, review documentation, consult with team members, and then complete the transition-all within a single logical session. The 30-minute assertion expiry breaks this flow. We implemented a combination of extended assertion lifetime and session persistence to solve it. Make sure your session store is configured to maintain state even when assertions expire.

10

Look at the NotOnOrAfter attribute in your SAML assertions. That’s what’s controlling the 30-minute limit. You can configure this at the IdP level, but also check if Teamcenter is enforcing additional validation rules.