Identity Portal session didn't logout after close browser tab

[JZ Chin]

Hi All,

The Identity Portal session didn't logout after i close Identity Portal browser tab directly without logout.

I can bypass the credential login if i use the browser reopen recent close tab function or open Identity Portal bookmark before my session timeout.

Can Identity Portal be configure to logout or drop the user session if user close the browser tab?

[Bill Patton]

Looking through our docs here:
https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/layer7-identity-and-access-management/identity-portal/14-3/administrating/administrating-ca-identity-portal/ca-identity-portal-administration/elements/security/configure-advanced-authentication-settings.html

I did not see anything on invalidating a session where the tab was closed. 

I do know that if you integrate CA SSO you have a lot more control of the cookie and session data.

Bill Patton

------------------------------
And, as always Perhaps there are others in the communities who have experience in doing this and we invite them to comment here also.

Another option may be to reach out to our partner HCL Technologies to see in what way they can assist further. The Enterprise Studio team of HCL can be reached at [e-mail]. https://www.hcltech.com/enterprise-studio
------------------------------

[Vijay Mamidi]

Hi Jin,
          Invalidating user session on browser window unload when user clicks on browser's close (X) button is not recommended for application like Identity Portal which supports opening up multiple browser windows (or tabs) and allow users to work simultaneously on different features/modules of the application. 
          Assume that you have opened up two different modules (1. Access 2. My Requests) in two different tabs of the browser to work simultaneously. Once you are done working with My Requests module, you may prefer to close that browser window and continue to work with Access module on an another window. Considering your request, if we invalidate the session upon closing the browser window, you will be prompted for authentication to continue your work on another window i.e., Access module window. Which is not a desired user experience. 
         So, it's cautious design decision to not to invalidate the session upon browser window close. So that user can continue to work until actual session timeout takes place.

------------------------------
Vijay Mamidi,
Identity Governance & Administration,
Broadcom.
------------------------------