Skip to main content

This content has been archived and is no longer being updated. Links may not function; however, this content may be relevant to outdated versions of the product.

Support Article

Container managed Authentication does not kill session

SA-24980

Summary



User is using Container Managed Authentication, when the User1 logged in to system and log out, the User1 session will not be terminated until close browser.


Error Messages



Not Applicable.


Steps to Reproduce



1. Configure system to Container Managed Authentication.
2.  Log into system as 
User1 successfully.
3. Log off User1 and login by User2. System still show the current user is User1.
4. Alternatively, User1 log off, type the Pega URL in the same browser, system logs in to application automatically without prompt login screen. Application shows User1's profile. Sometimes, it is not able to find requester from SMA for container managed authentication user.


Root Cause



There was three level of authentication being done:

1) WebSEAL
2) Container Managed Authentication (WebSphere)
3) PRPC  (Contain Managed Authentication)


There was no logoff from PRPC being done when they clicked "Logoff". Changes were made to standard PRPC logoff to directly call the WebSEAL logoff.  

With no logoff from PRPC the same session was being used. Also, logoff from the Container, WebSphere is also needed. 

Resolution



PRPC authentication is session based using a standard Session Cookie named Pega-Rules.
When using custom authentication one must logoff of PRPC to end the PRPC session and set the Pega-RULES cookie to "None". 

Instead of modifying the Logoff links just use the standard PRPC logoff functionality.
Then add customizations to the Web-Session-Return HTML rule. This HTML is displayed after the user has been logged off of PRPC and the session cookie Pega-RUELS is set to "none".
Add redirects here to logoff of third party security software as required.


 

 

Suggest Edit

Published July 2, 2016 - Updated October 8, 2020

Did you find this content helpful? Yes No

Have a question? Get answers now.

Visit the Collaboration Center to ask questions, engage in discussions, share ideas, and help others.

We'd prefer it if you saw us at our best.

Pega Community has detected you are using a browser which may prevent you from experiencing the site as intended. To improve your experience, please update your browser.

Close Deprecation Notice
Contact us