We are using this same approach in our Sitecore solution. The main challenge we ran into is that the SecurityTokenValidated event from the OWIN middleware, where you receive the token, runs before the AcquireRequestState lifecycle event from IIS where the session state gets instantiated. Therefore we were unable to use the Sitecore private session state
Ken, good question. Sitecore maintains an ASP.NET Session state outside the process to share between CDs (in fact 2 session states).
The session state is used to flush Analytics data to xDB on Session End.
The problem, thought, only InProc ASP.NET provider supports/raises the event OOB.
Therefore Sitecore had to cook their own providers.
Point 1: do you use ...