title: How can I make a security token automatically expire in a passive STS setup?
body: <p>I have a passive STS set up for a new application I'm working on.</p>
  
  <p>I've noticed that when a user's session expires, the user is still authenticated.  I would have thought that when the session expires, the user would no longer be authenticated.  My boss discussed this with me as I am currently charged with setting up the authentication.  He says that it would be good if we could make the user's log on expire after a certain period of inactivity similar to how the session expires.</p>
  
  <p>I am familiar with how to sign a user out with a few lines of code.  How can I make it so that the user is automatically signed out after a specified period of inactivity?</p>
  
  <p>Currently, I have some code in the <code>global.asax</code> file that programmatically checks when the last request was and compares it to the current time; it then signs the user out if a certain period of time has expired.</p>