Identity Manager Forgotten Password Cancel Action Redirects to Incorrect Protocol

Products

• CA Identity Manager
• SITEMINDER

Issue/Introduction

When users cancel an operation on the "Forgotten Password" screen within an Identity Manager environment integrated with SiteMinder (SSO), they may be incorrectly redirected to an HTTP URL rather than an HTTPS URL. This mismatch often leads to browser-side errors, interrupting the user's secure session. This article identifies common configuration issues causing this protocol redirect error.

Environment

Identity Manager 14.x & 15

Cause

The logoffUri in the SSO Agent Configuration Object (ACO) is not configured correctly.

The ACO for the IM environment in SiteMinder had the logoffURI pointing to an unfamiliar, incorrect JSP.  Per the IM documentation, when SSO is protecting IM, the IM logout.jsp does not do anything. Instead, the ACO logoffURI needs to be set to /iam/im/logout.jsp.



Another cause would be an incorrect Base URL for the Environment in IDM Management Console. 

Resolution

The redirect behavior is typically caused by one of two misconfigurations. Please check both settings below.

Cause 1: Incorrect SiteMinder SSO Agent (ACO) logoffUri configuration The logoffUri in the SSO Agent Configuration Object (ACO) must be explicitly defined to ensure the SSO agent recognizes the logout request.

1. Log in to the SiteMinder AdminUI.
2. Navigate to your Agent Configuration Object (ACO) for the Identity Manager environment.
3. Locate the logoffUri setting.
4. Ensure the value is set to: /iam/im/logout.jsp
   • Note: Using an incorrect or outdated JSP path will prevent the SSO agent from processing the logout request correctly.

Cause 2: Incorrect Environment Base URL in Identity Manager Management Console If the logoffUri is configured correctly, verify that the Identity Manager environment's Base URL is set to HTTPS.

1. Log in to the Identity Manager Management Console.
2. Navigate to Environments > [Environment Name].
3. Locate the Base URL field.
4. Ensure the URL uses the https:// protocol and the correct secure port (e.g., https://idm.example.com:8443).
5. Save your changes.
   • Note: If this field is set to http://, the application will default to using the insecure protocol for redirects, even if the user is currently operating within a secure session.

Additional Information

For more information see the documentation below:

Configure the LogOff URI - 14.5

Configure the LogOff URI - 15.0