Persistent session causes unexpected user logout

Products

• SITEMINDER
• CA Single Sign On Agents (SiteMinder)
• CA Single Sign On Federation (SiteMinder)
• CA Single Sign On Secure Proxy Server (SiteMinder)

Issue/Introduction

A site is configured with two SSO zones, SM and SM2.   There is a one-way trust in which SM2 trusts SM.  With non-persistent sessions, when the user is logged out of the SM zone due to idle activity, the user's session in the SM2 zone remains valid since the user was active in the SM2 zone while idle in the SM zone.  This allows the user to continue accessing resources in the SM2 zone.

Once persistent sessions are enabled, when the user is logged out of the SM zone, they are no longer able to access resources in the SM2 zone despite being active in the SM2 zone while idle in the SM zone.  

Cause

This occurs because instead of only invalidating the SMSESSION cookie and clearing agent session cache wherever that cookie was used, with persistent sessions enabled the centrally stored session becomes authoritative.  This centrally stored session is invalidated when the user is logged out of any zone, thus when the user is logged out of the SM zone, they are also effectively logged out of the SM2 zone. 

In this particular use case, the application in the SM zone is automatically sending the user to the web agent's LogOffURI when the user reaches the maximum idle time.  This causes the effective logout of all sessions/zones.  

Resolution

There is no way to unlink multiple SSO zone cookies that were obtained via a single persistent session.  The best way to address this scenario is to not allow the application to attempt to manage the user's Siteminder session.  Without this automatic logout that is performed by the application (it performs the logout after the max idle activity in the absence of the user making a request), the user would be able to continue working in the SM2 zone so long as they do not request any resources in the SM zone after the idle timeout is reached.  This is because Siteminder doesn't proactively log out user sessions when the idle timeout is reached.  Instead, Siteminder determines the user's session status upon each request made by the user.

As the user is continuously active in the ABC zone in this scenario, the user's centrally stored session is constantly updated and that session does not become idle.  Therefore, if the application in the SM zone does not automatically log the user off, the user will be able to continue working in the SM2 zone.