Cross-User Session Interference in PAM Browser

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

When multiple PAM users with different privilege levels authenticate concurrently within the same browser profile, the web session or authorization context of one user may interfere with another. This issue occurs because the browser shares the same session cookies across tabs or windows within a single profile.

Environment

• Privileged Access Manager (PAM): All versions
• Browser: Microsoft Edge, Google Chrome, and other Chromium-based browsers

Cause

Browser session cookies are shared across all tabs and windows within the same browser profile. When a user authenticates in one tab, the PAM server associates the session with that browser profile. If another user authenticates in a different tab within the same profile, the browser may send conflicting or stale session cookies to the PAM server, leading to authorization errors (e.g., PAM-UI-1003, PAM-UI-1005) or potential cross-user authorization crossover.

Resolution

To ensure proper session isolation and security, use one of the following methods when working with multiple PAM sessions or different users:

1. Use Separate Browser Profiles: Configure distinct browser profiles for each PAM user. Each profile maintains its own isolated cookie and cache environment.
2. Use Incognito or Private Windows: Open each PAM session in a separate Incognito or Private browser window. This forces the browser to treat each window as an isolated environment with its own unique session cookies.
3. Clear Browser Data: If you must use a shared profile, close all tabs and clear the browser cache and cookies before switching to a different user account

If you continue to experience session issues after isolating browser profiles, Contact Support for assistance.