Contents
The FedAuth cookie is a cookie for the user’s session. Also inside the FedAuth cookie is a reference to the SAML token stored in SharePoint’s token cache (i.e. on the server). This reference is so SharePoint can keep track of who the user is and what they can access.
Decode the fedauth token If you have retrieved the FedAuth token and made sure the certificate is the correct one then paste the Base64 string into the application I provided. Select the correct certificate and click decode. It then prints out the Identity and claims that are provided within the SessionToken.
What is fed Auth?
FedAuth Cookie is what is used with Claims Authentication. SharePoint STS will issue the FedAuth Cookie which contains the references to the claims token. Claim tokens are actually stored separately.
How do I get an access token in SharePoint online?
Getting an Access Token for SharePoint Online
- Step 1 Register an App. Navigate to https://[TENANT -NAME].sharepoint.com/_layouts/15/appregnew.aspx.
- Step 2 Grant APP-Only permission to the APP. Navigate to https://[TENANT-NAME].sharepoint.com/_layouts/15/appinv.aspx.
- Step 3 Get access token.
The FedAuth cookie is a cookie for the user’s session. Also inside the FedAuth cookie is a reference to the SAML token stored in SharePoint’s token cache (i.e. on the server). This reference is so SharePoint can keep track of who the user is and what they can access.
What is the value of a fedauth Cookie?
The FedAuth cookie value is chunked into two cookies, FedAuth and FedAuth1. I managed to base64 decode and combine them into well-formed xml containing the cookie with a value that appears to be base64 encoded.
What is SAML token and fedauth Cookie?
The FedAuth cookie is a cookie for the user’s session. Also inside the FedAuth cookie is a reference to the SAML token stored in SharePoint’s token cache (i.e. on the server).
When is the root Federation authentication ( RTFA ) Cookie deleted?
The root Federation Authentication (rtFA) cookie is used across all of SharePoint. When a user visits a new top-level site or another company’s page, the rtFA cookie is used to authenticate them silently without a prompt. When a user signs out of SharePoint, the rtFA cookie is deleted. Session and persistent cookies