Domain cookie issues

What version are you running?

What version are you running?

Hello,

Solution 1: You can define a multidomain sso access profile and attach it to every VS (but mix between web access and webtop is sometimes bad)

Solution 2: you setup each VS as SAML SP and you add a SAML idp to authenticate users. Once a user is authenticated on the IDP,he can go to every app that rely on the same IDP without further authentication

Solution 3: in v12.0.0, you have now a scope option in each access profile. I think you can extend the scope and allow access to other apps.

Solution 4: you use irule to make it works your way. I already developed irules to manipulate apm sessions and it works fine in many cases

But to solve this issue, you first need to stop having an apm cookie that spread the whole domain: domain.com

You can have only one MRHSession by hostname.

Hello,

Solution 1: You can define a multidomain sso access profile and attach it to every VS (but mix between web access and webtop is sometimes bad)

Solution 2: you setup each VS as SAML SP and you add a SAML idp to authenticate users. Once a user is authenticated on the IDP,he can go to every app that rely on the same IDP without further authentication

Solution 3: in v12.0.0, you have now a scope option in each access profile. I think you can extend the scope and allow access to other apps.

Solution 4: you use irule to make it works your way. I already developed irules to manipulate apm sessions and it works fine in many cases

But to solve this issue, you first need to stop having an apm cookie that spread the whole domain: domain.com

You can have only one MRHSession by hostname.

Hello,

Please find below a small irule to get a session cookie from another App1 (protected by APM) and play Basic SSO to the App2. I keep a APM profile on App2, in case that the first connection come here.

when HTTP_REQUEST {
        set apm_cookie [HTTP::cookie value MRHSession]
    if { [ACCESS::session exists -state_allow -sid $apm_cookie] } {
        ACCESS::disable
                set username [ACCESS::session data get -sid $apm_cookie session.logon.last.username]
                set password [ACCESS::session data get -sid $apm_cookie -secure session.sso.custom.password]
                set basic $username:$password
                HTTP::header insert Authorization "Basic [b64encode $basic]"    
    }
}

You should not take this irule as-is because you probably need to add speicific actions. You can also define a variable at the begining of your VPE and add a condition that allow the session without any further processing if the variable is filled. Thus, you just need to replace few lines of code by :

 ACCESS:session data set session.logon.last.custom.sso 1