I've checked as many settings as I can find to check without hitting upon anything that would solve the issue in an app that uses Windows Authentication but it has to continually re-authenticate as it goes through the pages in it.
IIS7 - .net framework version 2.0.50727, in both Classic & Integrated Managed Pipeline Mode (the only difference I've seen thus far is that when an exception is thrown in Integrated it halts the app, but in Classic it throws a 405 & the app continues). App pool timeout = 20 minutes. Recycling is 1740 minutes.
Website - has both Anonymous & Integrated Windows Authentication enabled. Session State = In Process. Cookie settings: Mode - use Cookies, Name - ASP.NET_SessionID Time-out - 10080.
What happens is that pages you've authenticated to 30 seconds ago (the 401 handshaking) you have to authenticate against again & again. One change I made to the web.config that helped - some - was in the modules node - changing what was in the preCondition attribute from "managedHandler" to "integratedMode".
Your first pass thru the app's navigation (it is using AJAX in an expanding file folder to traverse sections in a file folder that are Silverlight objects) it works fine. Then, the second pass through, when you hit the first page of an object you've loaded previously, you're challenged (again) to authenticate to that page. All this can take place in a matter of just seconds.
The page itself is unchanged, what it loads is unchanged. I've not put a stopwatch on it, but any amount of idle time (maybe up to a minute?), re-navigation of data you've previously loaded - either will prompt a 401 challenge.
I find it hard to believe that something would expire that quickly, but how do you tell?
Any thoughts appreciated.
Thanks