Siteminder : Scenarios related to OIDC Refresh Token

Products

• CA Single Sign On Agents (SiteMinder)
• CA Single Sign On Federation (SiteMinder)
• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On SOA Security Manager (SiteMinder)
• SITEMINDER

Issue/Introduction

Information on different scenarios related to OIDC Refresh Token Lifecycle.

Environment

Siteminder Version: 12.8 SP7

Resolution

1. Can Refresh Token be issued indefinitely until it reaches its expiration time?

Yes, in CA SiteMinder, the refresh token can be issued indefinitely until its expiration time, as long as it is not manually revoked or invalidated by session changes. The refresh token will remain valid for as long as it hasn’t expired or been revoked, which means you can use it for repeated access token refreshes until it reaches its expiration time.

2. If I send Refresh Token(R1) to Token Endpoint, will a new Refresh Token(R2) be issued together with a new Access Token(A2)?

In CA SiteMinder, when you send Refresh Token (R1) to the token endpoint, a new Access Token (A2) will be issued, but a new Refresh Token (R2) will not be issued by default. The same refresh token (R1) will remain valid for further use until it expires or is manually revoked.

If you need automatic refresh token rotation (where a new refresh token is issued each time), this feature is available in later versions of SiteMinder, but not in 12.8.07 or earlier unless you have implemented custom behavior.

 

3. (If a new Refresh Token is issued in 2.) If I receive a new Refresh Token(R2) with the initially generated Refresh Token(R1) and send R1 to Token Endpoint, will it recognize it as an invalid Refresh Token and invalidate both R1 and R2?

In CA SiteMinder, if you send R1 (the initially issued refresh token) to the token endpoint after R2 (a new refresh token) has been issued, R1 will not be automatically invalidated unless you have explicitly configured SiteMinder to do so through a custom policy. R1 will likely still be accepted as valid, and both R1 and R2 could remain valid for use until their respective expiration times or until they are manually revoked (e.g., via user logout).

 

 

Additional Information

Please refer the below documentation for the new features of Refresh Token Rotation starting from the 12.8 SP8 and later.

https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/siteminder/12-8/configuring/use-siteminder-as-openid-connect-provider/configure-siteminder-as-openid-connect-provider.https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/siteminder/12-8/release-notes/New-Features/new-features-in-12-8-08.html#concept.dita_05d65b0a-d14d-4e58-8aae-dae6e2f99f5c_SupportforRefreshTokenRotationhtml