User Re-prompted in Loop for Credentials on Second Domain When Using Cookie Provider (limitcookieprovider=YES)

Products

• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign-On
• CA Single Sign On Agents (SiteMinder)
• SITEMINDER

Issue/Introduction

When running two Web Agents on different domains, a user authenticated on domain .example.com is prompted for credentials again when attempting to access a protected resource on domain .example.org. Single Sign-On (SSO) between the two domains is expected to work automatically via the Cookie Provider.

The SMSESSION cookie for domain .example.org is not being created by the Cookie Provider hosted on .example.com prior to redirecting the user to the protected resource.

Environment

• CA Single Sign-On (SiteMinder) Policy Server 12.8.x, 12.9
• Web Agent with Cookie Provider enabled

 

Resolution

The Cookie Provider Agent Configuration Object (ACO) had the parameter limitcookieprovider set to YES (1). When this parameter is set to YES, the Cookie Provider only creates SMSESSION cookies for its own domain and refuses to create cookies for other domains. As a result, cross-domain SSO fails and the user is prompted for credentials when accessing the second domain.

To resolve the issue, set limitcookieprovider to NO in the Cookie Provider's ACO.

1. Access the Administrative UI.
2. Navigate to the Agent Configuration Object (ACO) associated with the Cookie Provider.
3. Locate the parameter limitcookieprovider.
4. Set the value to NO.
5. Save the changes.
6. Restart the Web Agent.

Sample configuration after fix:

Cookie Provider

https://cookieprovider.example.com/

[18648/2428991232][Mon Sep 11 2017 16:18:34] cookiedomain=''.
[18648/2428991232][Mon Sep 11 2017 16:18:34] cookiedomainscope='0'.
[18648/2428991232][Mon Sep 11 2017 16:18:34] enablecookieprovider='yes'.
[18648/2428991232][Mon Sep 11 2017 16:18:34] limitcookieprovider='no'.
[18648/2428991232][Mon Sep 11 2017 16:18:34] trackcpsessiondomain='yes'.
[18648/2428991232][Mon Sep 11 2017 16:18:34] tracksessiondomain='yes'.

Web Agent

https://server.example.org/protected/index.html

[14869/738195200][Mon Sep 11 2017 16:18:34] cookiedomain='.example.org'.
[14869/738195200][Mon Sep 11 2017 16:18:34] cookiedomainscope='0'.
[14869/738195200][Mon Sep 11 2017 16:18:34] cookieprovider='https://cookieprovider.example.com/siteminderagent/SmMakeCookie.ccc'.
[14869/738195200][Mon Sep 11 2017 16:18:34] enablecookieprovider='no'.
[14869/738195200][Mon Sep 11 2017 16:18:34] limitcookieprovider='no'.
[14869/738195200][Mon Sep 11 2017 16:18:34] tracksessiondomain='yes'.

Additional Information

1. List of Agent Configuration Parameters