Configure the Siteminder AdminUI to set the 'Samesite' attribute on the JSESSIONID Cookie

Products

• SITEMINDER

Issue/Introduction

Some security scans may determine that the JSESSIONID cookie tied to the URL of the Siteminder AdminUI might need to have the Samesite flag set.

 

Environment

Component: Siteminder AdminUI

Release : 12.8.x

Cause

The SameSite attribute of the Set-Cookie HTTP response header allows you to declare if your cookie should be restricted to a first-party or same-site context.

Resolution

1) Download the file "1674239267076__AdminUI-Samesite-Fix.zip" attached to this KB

2) Copy the file "1674239267076__AdminUI-Samesite-Fix.zip" to the Siteminder AdminUI host and unzip it.

3) Stop the Siteminder AdminUI

4) Browse to the following directory:

<AdminUI_Install_Dir>\adminui\modules\com

5) Copy the folder named "broadcom" from "1674239267076__AdminUI-Samesite-Fix" to <AdminUI_Install_Dir>\adminui\modules\com\

6) After copying the 'broadcom folder, verify that the following files and directory structure are present:

<AdminUI_Install_Dir>\adminui\modules\com\broadcom\websec\filter\main\modules.xml

<AdminUI_Install_Dir>\adminui\modules\com\broadcom\websec\filter\main\samesitefilter.jar

7) Backup the following file:

<AdminUI_Install_Dir>\adminui\standalone\configuration\standalone-ful.xml

8) Edit the following file: 

<AdminUI_Install_Dir>\adminui\standalone\configuration\standalone-ful.xml

9) Within the file "standalone-full.xml" locate the following entry:

<subsystem xmlns="urn:jboss:domain:undertow:8.0......."

10) Within the [<subsystem xmlns="urn:jboss:domain:undertow:8.0] section, locate the <filters> section

        <!-- 
            <filters>
                <response-header name="server-header" header-name="Server" header-value="WildFly/8"/>
                <response-header name="x-powered-by-header" header-name="X-Powered-By" header-value="Undertow/1"/>
            </filters>
        -->

11) Modify the <filters> section as follows:

     <filters>
          <!--<response-header name="server-header" header-name="Server" header-value="WildFly/8"/>
          <response-header name="x-powered-by-header" header-name="X-Powered-By" header-value="Undertow/1"/> -->
          <filter class-name="com.broadcom.websec.filter.SameSiteCookieHandler" module="com.broadcom.websec.filter" name="samesitecookiehandler">
               <param name="sameSite" value="None"/>
          </filter>
     </filters>

NOTE: <!-- --> is a wrapper that comments out the values.  You could simply remove the default response headers complete, if you prefer.

    <filters>
        <filter class-name="com.broadcom.websec.filter.SameSiteCookieHandler" module="com.broadcom.websec.filter" name="samesitecookiehandler">
            <param name="sameSite" value="None"/>
        </filter>
    </filters>

NOTE: Within the 'value=' attribute for the parameter named "SameSite" [<param name="sameSite" value=  ]  you will populate with one of the supported SameSite values. (e.g.: None | Lax | Strict) Please ensure you have provided one these values exactly

12) Within the file "standalone-full.xml" locate the following entry:

     <host alias="localhost" name="default-host">

13) Implement the following change:

     <host alias="localhost" name="default-host">
          <filter-ref name="samesitecookiehandler"/>
          <location handler="welcome-content" name="/"/>
          <http-invoker security-realm="ApplicationRealm"/>
     </host>

NOTE: There are examples in the sample copy of the 'standalone-full.xml' within "1674239267076__AdminUI-Samesite-Fix".  That copy is NOT intended to replace your existing 'standalone-full.xml', it is merely there for reference purposes.  DO NOT replace your copy of 'standalone-full.xml' with the same copy provided.

14) Start the Siteminder AdminUI server

15) Using a web browser trace tool, logon to the Siteminder AdminUI and review the JSESSIONID cookie in the responses to verify the solution is working.