Symantec Access Management

 View Only

Tech Tip : CA Single Sign-On : WAOP and SSOZoneName: Loop with expired session

  • 1.  Tech Tip : CA Single Sign-On : WAOP and SSOZoneName: Loop with expired session

    Broadcom Employee
    Posted May 08, 2019 08:20 AM

    We're running IdP and SP on different machines but with the same
    Domain Name. We segregate the cookies using SSOZoneName ACO
    parameter. Once the SP session terminates, both IDP SMSESSION and SP
    MY_SESSION cookies gets the value of LOGGEDOFF. The SP MY_SESSION
    cookie gets removed from the browser. But the SMSESSION cookie

    As the SMSESSION cookie reaches the IDP Web Agent Option Pack, the
    transaction fails and the IDP Web Agent Option Pack reports not to be
    able to decode the SMSESSION cookie.

    cookie array) cookie value: LOGGEDOFF]

    trusted zone: SM]


    to validate using SMSESSION cookie.]

    not decryptSMSESSION cookie. Error message: Tried out all the decrypt
    keys, decryption failed..]

    How can we fix that ?
    The problem is that the SMSESSION=LOGGEDOFF cookie reaches the Web
    Agent Option Pack at IDP side and that there's no Web Agent to handle
    this SMSESSION=LOGGEDOFF and to remove it from the browser. The Web
    Agent only handle the MY_ cookie. It's configured with
    SSOZoneName=MY_. More, out of the box, the Web Agent Option Pack
    doesn't remove any cookies from the browser. The aftermath is that the
    SMSESSION=LOGGEDOFF arrives to the IDP Web Agent Option Pack and this
    one cannot handle the value LOGGEDOFF.

    The IDP Web Agent Option Pack is configured to trust SM and MY_
    cookies :


    [246584/148340][Thu Apr 04 2019
    16:53:35][][INFO][sm-FedClient-00190] SSOZoneName
    not specified. Using default: SM

    [246584/148340][Thu Apr 04 2019
    SSOTrustedZone specified as: [SM, MY_]

    but its Web Agent is configured to handle only MY_ cookie :


    [47970/3387586304][Thu Apr 04 2019 17:34:23] ssozonename='MY_'.

    The Web Agent on the SP Side is configured to handle the same cookie
    as per IDP :

    The SP :


    [111815/4064990976][Thu Apr 04 2019 18:56:28] ssozonename='MY_'.

    The MY_SESSION is expired, get logged out, and removed from the
    browser by the Web Agent :


    cookie has expired and will not be used to authenticate.]

    [/affwebservices/public/saml2sso?SPID=mysp][Unable to process
    MY_SESSION cookie.]

    [Executing expired cookie redirect.]

    [SM_WAF_HTTP_PLUGIN->EstablishSession returned SmNoAction.]

    [Calling LogoutSession for session '+9HDjvKRwdasdasdC4hsC4+4d4='.]

    95][LogoutSession][][][][][][][Session logged out.]

    59b4b47b-9020fbcf-3630f2e0-eec][][Deleted cookie 'MY_SESSION'.]

    but as the Web Agent is configured to handle the MY_ session cookie,
    then the SMSESSION cookie never gets removed from the browser. The IDP
    Web Agent Option Pack then is unable to decode the SMSESSION value and
    the transaction fails. User doesn't get redirected to the login page.

    If you replay the issue, and at time you get the problem, you go in
    the memory of the browser and you remove the SMSESSION=LOGGEDOFF
    cookie, then you will be in the flow again.

    Use 2 different Web Agents having different ACO's and different
    SSOZoneName values to solve the issue.

    You might also customize the Apache Server to remove the SMSESSION=LOGGEDOFF
    cookie from the browser.

    KB : KB000131888