Symantec Scoping in IGA stuck in cache even after new session is established

Products

• CA Identity Suite

Issue/Introduction

There is a problem that sometimes users report that there are no available tasks in the modules when they click, and it looks like this happens when the session ends, and they click "cancel" or "ok" and then click on a module with no active session. 

After that, even after refreshing to get a new session or after cleaning the cookies and client cache, 

The problem persists, and the call for https://server.name/sigma/rest/protected/invocationoperation/scoping/... returns an empty json.

Environment

IGA 14.5.1

Cause

When a Siteminder session expires or ends abruptly, the Identity Portal may retain a "stale" or "empty" scoping result in its internal cache. Because Siteminder Web Agents cache sessions to reduce Policy Server load, a "logged out" session may still be seen as active by the agent until the cache expires, causing the Portal to receive inconsistent session data during the scoping call.

Resolution

Enable Comprehensive Log Out: Ensure Siteminder is configured for Comprehensive Log Out so that session cookies are properly invalidated across the environment. Users' Web Agent session remains active after logout.

Configure Session Flush on Logout: Add the Policy Server registry key EnableFlushUserCmdOnLogout (set to 1) to force the flushing of users from the session store cache immediately upon logout. Users' Web Agent session remains active after logout.
Adjust Session Validation Period: Decrease the Session Validation Period on the Siteminder Realm, protecting the Portal to a lower value (e.g., 30 seconds or less). This increases the frequency at which the agent checks the Policy Server to verify session validity. Session invalidation after 30 seconds.