When you do a session refresh via "server task refresh all_sessions" it seems that the cookie jar is cleared. We experienced strange behavior after a session refresh and a pdweb.debug confirmed that indeed the cookies are missing after a session refresh. I suppose this is not the expected behavior as it severely limits the usefulness of both these features.

------------------------------
Laurent LA Asselborn
------------------------------

Hi Hans,

The clear-cookie-jar-on-reauth parameter did indeed solve the problem.

Best regards,

Laurent

===========

 Hi Laurent,

I was just experimenting with the cookie-jar, to allow keeping a cookie when transitioning from an unauthenticated session to an authenticated session (e.g. when doing a SAML authentication in ISAM, to keep the JSESSIONID and FIM cookie in the cookie jar for the unauth and auth part of the flow).

To allow that to work, I had to use/add the following (not very well documented) parameter:

[server]
clear-cookie-jar-on-reauth = no

 

Can you also give that a try in your scenario (s t refresh all_sessions), as I believe this might just do what you need.

Best regards,
Hans

===========

------------------------------
Laurent LA Asselborn
------------------------------

Hi Laurent,

I was just experimenting with the cookie-jar, to allow keeping a cookie when transitioning from an unauthenticated session to an authenticated session (e.g. when doing a SAML authentication in ISAM, to keep the JSESSIONID and FIM cookie in the cookie jar for the unauth and auth part of the flow).

To allow that to work, I had to use/add the following (not very well documented) parameter:
[server]
clear-cookie-jar-on-reauth = no

Can you also give that a try in your scenario (s t refresh all_sessions), as I believe this might just do what you need.

Best regards,
Hans

------------------------------
HANS VANDEWEGHE
------------------------------