Keep Me Signed In (KMSI) is popularly used around the web-based software world to provide users with a login assurance that persists beyond the current session. In AD FS land, Microsoft call this Persistent SSO. Persistent SSO encapsulates a number of technologies, but the simplest of these is KMSI. KMSI will provide a user with a 24-hour cookie, allowing for logins to persist across browser sessions for up to a day.
Enable the KMSI checkbox with the following simple command on your Primary AD FS server:
Set-AdfsProperties -EnableKmsi:$trueEasy as that! Run this command and your AD FS login page will update and look something like this:
If you start poking through cookies, you’ll see the validity of the sign-in token change. With KMSI off, the cookie is only valid for this session:
With KMSI on, the cookie is valid for 24 hours from the second it is provided to me:
Comments/questions
There's no commenting functionality here. If you'd like to comment, please either mention me (@[email protected]) on Mastodon or email me. I don't have any logging or analytics running on this website, so if you found something useful or interesting it would mean a lot to hear from you.