Configure the Siteminder AdminUI to set the 'Samesite' attribute on the JSESSIONID Cookie

Products

SITEMINDER

Issue/Introduction

Some security scans may determine that the JSESSIONID cookie tied to the URL of the Siteminder AdminUI might need to have the Samesite flag set.

Environment

Component: Siteminder AdminUI

Release : 12.8.x

Cause

The SameSite attribute of the Set-Cookie HTTP response header allows you to declare if your cookie should be restricted to a first-party or same-site context.

Resolution

1) Download the file "1674239267076__AdminUI-Samesite-Fix.zip" attached to this KB

2) Copy the file "1674239267076__AdminUI-Samesite-Fix.zip" to the Siteminder AdminUI host and unzip it.

3) Stop the Siteminder AdminUI

4) Browse to the following directory:

<AdminUI_Install_Dir>\adminui\modules\com

5) Copy the folder named "broadcom" from "1674239267076__AdminUI-Samesite-Fix" to <AdminUI_Install_Dir>\adminui\modules\com\

6) After copying the 'broadcom folder, verify that the following files and directory structure are present:

<AdminUI_Install_Dir>\adminui\modules\com\broadcom\websec\filter\main\modules.xml

<AdminUI_Install_Dir>\adminui\modules\com\broadcom\websec\filter\main\samesitefilter.jar

7) Backup the following file:

<AdminUI_Install_Dir>\adminui\standalone\configuration\standalone-ful.xml

8) Edit the following file:

<AdminUI_Install_Dir>\adminui\standalone\configuration\standalone-ful.xml

9) Within the file "standalone-full.xml" locate the following entry:

<subsystem xmlns="urn:jboss:domain:undertow:8.0......."

10) Within the [<subsystem xmlns="urn:jboss:domain:undertow:8.0] section, locate the <filters> section

11) Modify the <filters> section as follows:

NOTE:  is a wrapper that comments out the values. You could simply remove the default response headers complete, if you prefer.

NOTE: Within the 'value=' attribute for the parameter named "SameSite" [<param name="sameSite" value= ] you will populate with one of the supported SameSite values. (e.g.: None | Lax | Strict) Please ensure you have provided one these values exactly

12) Within the file "standalone-full.xml" locate the following entry:

<host alias="localhost" name="default-host">

13) Implement the following change:

<host alias="localhost" name="default-host">
<filter-ref name="samesitecookiehandler"/>
<location handler="welcome-content" name="/"/>
<http-invoker security-realm="ApplicationRealm"/>
</host>

NOTE: There are examples in the sample copy of the 'standalone-full.xml' within "1674239267076__AdminUI-Samesite-Fix". That copy is NOT intended to replace your existing 'standalone-full.xml', it is merely there for reference purposes. DO NOT replace your copy of 'standalone-full.xml' with the same copy provided.

14) Start the Siteminder AdminUI server

15) Using a web browser trace tool, logon to the Siteminder AdminUI and review the JSESSIONID cookie in the responses to verify the solution is working.

Additional Information

Visual demonstration of applying the patch based on R12.8SP7 AdminUI.

This is the configuration section from the sample standalone-full.xml bundled with the patch.

<subsystem xmlns="urn:jboss:domain:undertow>
    <server name=" default-server">
        <host alias="localhost" name="default-host">
            <filter-ref name="samesitecookiehandler"/>
        </host>
    </server>
    <filters>
        <filter class-name="com.broadcom.websec.filter.SameSiteCookieHandler" module="com.broadcom.websec.filter" name="samesitecookiehandler">
            <param name="SameSite" value="Strict"/>
        </filter>
    </filters>
</subsystem>

Following section is the actual standalone-full.xml file in R12.8SP7

<subsystem xmlns="urn:jboss:domain:undertow:12.0" default-security-domain="other" default-server="default-server" default-servlet-container="default" default-virtual-host="default-host" statistics-enabled="${wildfly.undertow.statistics-enabled:${wildfly.statistics-enabled:false}}">
    <buffer-cache name="default"/>
    <server name="default-server">
        <http-listener enable-http2="true" name="default" no-request-timeout="120000" redirect-socket="https" socket-binding="http"/>
        <https-listener enable-http2="true" enabled-cipher-suites="SSL_RSA_WITH_RC4_128_MD5,SSL_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA" enabled-protocols="TLSv1.1,TLSv1.2" name="https" no-request-timeout="120000" security-realm="SSLRealm" socket-binding="https"/>
        <host alias="localhost" name="default-host">
            <location handler="welcome-content" name="/"/>
            <http-invoker security-realm="ApplicationRealm"/>
        </host>
    </server>
    <servlet-container name="default">
        <jsp-config x-powered-by="false"/>
        <websockets/>
    </servlet-container>
    <handlers>
        <file name="welcome-content" path="${jboss.home.dir}/welcome-content"/>
    </handlers>
</subsystem>

Following is after applying the configuration change in the actual standalone-full.xml

In case if the AdminUI fails to start after the configuration change, server.log will provide hints and most likely it would be configuration(xml) parsing issue.

In that case, just remove any whitespace from the section that you are adding to prevent the parsing issue.