CA SiteMinder® implements session management using session tickets. A session ticket contains basic information about a user and the authentication information for that user. The session ticket is used to identify the session of the user across all sites in a single sign–on CA SiteMinder® environment. Session tickets are encrypted and only the Policy Server can read/validate them. CA SiteMinder® web agents use session tickets to identify users and provide session information to the Policy Server.
The session ticket is handled differently depending upon whether the session is persistent or non–persistent.
Note: Non–persistent and persistent cookies are unrelated to the CA SiteMinder® session of the user being non–persistent or persistent.
The session ticket data is used as an index into the cache of the web agent, which contains the user session data. If a cookie is written, no user–specific data is kept in the cookie itself. The web agent is responsible for validating the session and enforcing the session timeouts.
- Non–persistent session
The web agent places the session ticket in a cookie. The cookie contains the user session data; no user-specific data is kept in the cookie itself. The web agent is responsible for validating the cookie and enforcing session timeouts. There is no session store database involved.
- Persistent Session
The web agent places the session ticket in a session store database (DataBase or CA Directory) and, if possible, in an optional cookie on the client.
With session store database in use, user login performance can be affected to some degree.
The session ticket data is used as an index into the cache of the web agent, which contains the user session data. If a cookie is written, no user–specific data is kept in the cookie itself. The web agent is responsible for validating the session and enforcing the session timeouts.
Hope this helps.
Hongxu