title: Is SessionSecurityToken lifeTime the same as sessionTokenRequirement lifetime?
body: <p>I'm migrating forms authentication in webforms across to Microsoft Identity.</p>
  
  <p>When creating a <code>SessionSecurityToken</code> using a  <code>ClaimsPrincipal cp</code> object, I have this code:</p>
  
  <pre><code>Dim token As New SessionSecurityToken(cp, TimeSpan.FromMinutes(30))
  </code></pre>
  
  <p>However, in web.config I also see this:</p>
  
  <pre><code>&lt;configSections&gt;
      &lt;section name="system.identityModel" type="System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" /&gt;
      &lt;section name="system.identityModel.services" type="System.IdentityModel.Services.Configuration.SystemIdentityModelServicesSection, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" /&gt;
  &lt;/configSections&gt;
  &lt;system.identityModel&gt;
      &lt;identityConfiguration&gt;
          &lt;securityTokenHandlers&gt;
              &lt;add type="System.IdentityModel.Tokens.SessionSecurityTokenHandler, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"&gt;
                  &lt;sessionTokenRequirement lifetime="00:30:00" /&gt;&lt;!-- 30 minutes --&gt;  
              &lt;/add&gt;
          &lt;/securityTokenHandlers&gt;
      &lt;/identityConfiguration&gt;
  &lt;/system.identityModel&gt;
  </code></pre>
  
  <p>Are these the same thing?  To prove I RTFM, <code>sessionTokenRequirement lifetime</code> <a href="http://msdn.microsoft.com/en-us/library/hh568645%28v=vs.110%29.aspx" rel="nofollow">is defined as</a>:</p>
  
  <blockquote>
    <p>Specifies the lifetime of session tokens.</p>
  </blockquote>
  
  <p><code>SessionSecurityToken lifetime</code> <a href="http://msdn.microsoft.com/en-us/library/hh158905%28v=vs.110%29.aspx" rel="nofollow">is defined as</a>:</p>
  
  <blockquote>
    <p>The period from the current time during which the token is valid. The ValidFrom property will be set to UtcNow and the ValidTo property will be set to ValidFrom plus the period specified by this parameter.</p>
  </blockquote>
  
  <p>The former seems vague, so I'm not sure.</p>