Identity Manager UI Session Loss and Redirects Through AccessGateway ALB

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

When accessing the Identity Manager (IDM) User Interface (UI) through an AccessGateway Application Load Balancer (ALB), users may experience unexpected redirects to the IDM homepage.

This often occurs after logging in successfully and attempting to perform a search or initiate a task. This redirection behavior is typically indicative of session state loss, preventing the application from maintaining the user's authenticated context.

Environment

Identity Manager 14.x

Cause

The session loss occurs when the jsessionid (the cookie used to track the user's session) is not correctly preserved or associated with the backend IDM server. If the Load Balancer does not maintain session stickiness (affinity), subsequent requests from the user's browser may be routed to a different node in the cluster or the session cookie may be dropped, causing the application to force a return to the homepage.

Resolution

To resolve session loss and prevent redirects to the homepage, review and update the configuration of your AccessGateway ALB:

1. Enable Session Stickiness (Persistence):
   • Ensure the Load Balancer is configured for Source IP Affinity or Cookie-based Persistence. This ensures that all requests within a single user session are directed to the same backend IDM server node.
2. Verify Cookie Preservation:
   • Check your ALB proxy rules to ensure that the jsessionid cookie is being passed through to the backend servers without modification.
   • If using an SSL-terminating Load Balancer, confirm that the cookie attributes (such as Secure or HttpOnly) are handled correctly and not stripped during traffic pass-through.
3. Cross-Check Proxy Rules:
   • If you have working DEV or TEST environments, perform a side-by-side comparison of the ALB proxy settings, paying close attention to header forwarding and cookie persistence rules.
4. Validate Backend Connectivity:
   • Verify that traffic from the ALB is correctly routed to all healthy IDM nodes in the cluster. If one node is failing to handle session cookies, it can cause intermittent redirects even if the ALB is generally functional.