For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Vinne73's avatar
Vinne73
Icon for Cirrus rankCirrus
Oct 19, 2015

APM multi domain SSO, incorrect timeout URL

Hi,   I've set up APM with multidomain SSO. Let's say I have a site "service.mydomain.com" and a login URL "login.mydomain.com".   Works fine, I go to service.mydomain.com, I don't have an APM ...
BIG-IP Access Policy Manager (APM)
security
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Oct 20, 2015

Just a question: am I correct in that this only works for a short while? Meaning that if the timeout happened long ago, the corresponding sid "parent" is already deleted from the table?

 

That is correct. You're at the mercy of the session table's timeout. The only other reasonable way would be to send the URI data to the client in a cookie.