如何使Siteminder会话无效

Question

We are using Siteminder for authentication and we are using Angular js which is Stateless.

How can I invalidate Siteminder Session. I have configured below in Spring Security. But it is not working for me.

In HTML

   <a href="../../logout">Sign Out</a></li>

In Spring Security

  <logout delete-cookies="JSESSIONID,SMSESSION" invalidate-session="true"  logout-url="/logout" logout-success-url="/Logout.html" />

In Logout.html we are providing a link to go to login page again. On clicking this, it should go to siteminder login page. But it is loading our welcome page instead.

We are thinking of invalidating SMSESSION so that the app will redirect to siteminder on clicking "Go To Login Page". Can some one assist me on this.

Update1 I tried setting SMSESSION=LOGGEDOFF in bot request and response objects of rest controller. But It is not working as there is no session maintained for angular and setting them in request/response just didnt help me

Answer 1

First of all, a HTTP trace would help a lot diagnosing this issue in practice.

Now for the theory: Removing the SMSESSION cookie from the client is an effective way of logging off the user IF the Siteminder Session Store is not used and CookieProviders are not used . Otherwise, it leaves the session still active on Siteminder side.

The proper, Siteminder supported way to do it is as such:

Your Siteminder administrator should be able to provide you an URI that will trigger proper Siteminder Logout. This URI is configured in the parameter LogoffUri in the involved agent ACO.

When any user with an active Siteminder session reaches this URI, the Siteminder Webagent and Policy Servers will:

• invalidate session data in Siteminder Session Store, if it is configured (by default it is not)

• if CookieProvider is used, it will trigger the appropriate redirections to remove cookies from all other cookie domains.

• add a "Set-Cookie: SMSESSION=LOGGEDOFF" header to the response (either a 302 if redirecting to the login page or 200 if the page is not protected). That will invalidate SMSESSION on client side.

• apply the defined Siteminder policy, if any (if the URI is protected, then the authentication scheme will apply, otherwise, the underlying WebServer will process the page)

When the user does not have a valid SMSESSION (and "LOGGEDOFF" is not a valid SMSESSION), he is considered as actually loggedoff.

Official doc is here (not that it is of much help...) https://support.ca.com/cadocs/0/CA%20SiteMinder%2012%2052%20SP1-ENU/Bookshelf_Files/HTML/idocs/index.htm?toc.htm?agent-guide.html