SSO Cookie Generation During SiteMinder Delegation to IDSP

Products

• Symantec Identity Security Platform - IDSP (formerly VIP Authentication Hub)

Issue/Introduction

You are integrating SiteMinder/Access Gateway with the Identity Security Platform (IDSP). In this configuration, SiteMinder fully delegates authentication to IDSP with the SSO mode set to 'Web SSO and Programmatic.' You need to understand how and when SSO cookies are generated during a successful authentication flow.

Environment

• Identity Security Platform (IDSP)
• SiteMinder / Access Gateway

Resolution

You can observe the following sequence of cookie generation when authentication is successful:

1. IDSP Session Cookie: When you send an authcomplete request to IDSP, IDSP sets the sspsession cookie.
2. SiteMinder Session Cookie: After the IDSP session is established, back-channel communication occurs. During this phase, the SiteMinder/Access Gateway bctokencontroller sets the SMSESSION cookie.

You can verify these cookies using browser developer tools (e.g., Google Chrome Developer Tools) under the Application or Network tabs to ensure both session tokens are correctly placed.