SiteMinder Not Authorizing the User when integrated with Layer7

Products

• SITEMINDER

Issue/Introduction

An SiteMinder application is integrated with Layer7.

Layer 7 uses the same SiteMinder cookie for its session validation.

Intermittently, user gets error 500, due to session is no longer valid.

When not working, error is only shown on layer 7 side log, Msg="Invalid SMSESSION cookie"; UserAgent=Layer7-SecureSpan-Gateway/v11.1.1-b18484;

In smps.log

[mm/dd/yyyy][11:52:04.688][11:52:04][1102021][140583085008640][SmAuthSession.cpp:483][CSmAuthSession::NeedsUpdate][][][][][][][][][][][][][][][][][][][][][][][][Update required; 1511 seconds since last update.

There is no other error message in SiteMinder side log.

Note: "Update SSO Token" check box is enabled from Layer7 side configuration properties.

Environment

SiteMinder: All versions

Layer7-SecureSpan-Gateway: v11.1.1-b18484

Cause

The session idle time out is 20 minutes=1200 seconds, so the layer 7 agent request (1511 seconds) has exceeded the limit (1200 seconds). 

Lastupdatetime is part of smsession attribute, only policy server can update it.

This means the lastupdatetime is not updated and when the layer 7 sends the ValidateAccept to the policy server, it is rejected due to exceeding the 20 minute timeout.

Despite the message, the session itself is still deemed valid. [** Status: Validated. ]

Resolution

This issue is resolved by reducing the apache ACO MaxSessionCache from 750 to 1 and since then no more SMSESSION validation errors from Layer7 Gateway. 

The particular data flow goes to apache agent first, then goes to layer7 agent.

Instead of fixing layer7 agent (lastupdatetime timestamp), one can chooses to force apache agent to send ValidateAccept request every time to policy server.

Prior this, the policy server only sees AZAccept all the time but not 'ValidateAccept'"from this apache agent.

Now, after the ACO change, every time apache Agent is sending to PS and PS is updating the lastupdatetime inside the cookie.

Because apache agent is able to get policy server to update lastupdatetime timestamp, layer7 agent does not need to do anything anymore.  Hence resolved the issue.

Alternative solution, or other possible work around from Layer 7 side:

1. Sync up the value of L7 SSO authentication/authorization cache maxAge properties. Currently AZ cache maxAge is set to 6 minutes, while authN cache max is not set, meaning the default 60 minutes will take effect.
2. Change the authorization assertion to use cookie.SMSESSION, which should address the issue.
3. Unlikely to be the root cause, but change the SSO authorization assertion target from response to request.

Using cookie.SMSESSION in the authorization assertion is the correct configuration when authenticating with the SMSESSION cookie as the user credential.