I'm trying to nail down how session handling works when using OIDC.  I haven't been able to find any real written confirmation.  

I think that all the session information is handled on the application side and webseal only cares about the token expiration time and the refresh token.  WebSEAL isn't maintaining any session information on you itself correct?

Is there any documentation that lays this out?

------------------------------
Jarrett Peterson
------------------------------

Hi Jarrett,

Any documentation available will be in the product docs.  I'm not sure how much it says about sessions though.

There are a number of places where the concept of  a "session" might apply in OIDC.

If ISAM is your OP, there will be a web session there when the user authenticates to access the /authorize endpoint.

If ISAM is your RP, there will be a web session there which is created when the incoming JWT is processed and exchanged for a SAM Credential.

A client might also use the Access/Refresh token acquired during SSO to make further API calls to endpoints protected by OP Access Manager (really this is now OAuth but closely related).  A session can be  created at WebSEAL for the OAuth client in this case - for performance.

Could you describe a little more about what you want to know?

Cheers... Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------

I believe we're trying to avoid using the pd-s/h session cookie and use the jwt as the key for the session similar to how you can do it with oauth.
Original Message:
Sent: 11-27-2018 06:34 AM
From: Jon Harry
Subject: OIDC & Session Handling

Hi Jarrett,

Any documentation available will be in the product docs.  I'm not sure how much it says about sessions though.

There are a number of places where the concept of  a "session" might apply in OIDC.

If ISAM is your OP, there will be a web session there when the user authenticates to access the /authorize endpoint.

If ISAM is your RP, there will be a web session there which is created when the incoming JWT is processed and exchanged for a SAM Credential.

A client might also use the Access/Refresh token acquired during SSO to make further API calls to endpoints protected by OP Access Manager (really this is now OAuth but closely related).  A session can be  created at WebSEAL for the OAuth client in this case - for performance.

Could you describe a little more about what you want to know?

Cheers... Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------

Hi Jarrett,

It is possible to have WebSEAL track sessions using any HTTP header where value is consistent for all requests in the same session and unique from values used in other sessions.  An Access Token sent in the Authorization header is an example of this.  To enable, you need to:

•   Set require-mpa = no
•   Add the HTTP header name to the to the [session-http-headers] stanza.  For example Authorization = https

Note that this functionality doesn't work if you have DSC enabled because DSC requires the use of the PD-x-SESSION-ID headers.

I wonder whether this approach will actually work with OIDC because the JWT token is usually only sent once (during the SSO flow) and is not sent in a header.  For this approach to work the JWT token would have to be sent in a header with every request... which assumes a client that is aware of this need.

Cheers... Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------

Original Message:
Sent: 11-28-2018 02:39 PM
From: Jarrett Peterson
Subject: OIDC & Session Handling

I believe we're trying to avoid using the pd-s/h session cookie and use the jwt as the key for the session similar to how you can do it with oauth.

Original Message:
Sent: 11-27-2018 06:34 AM
From: Jon Harry
Subject: OIDC & Session Handling

Hi Jarrett,

Any documentation available will be in the product docs.  I'm not sure how much it says about sessions though.

There are a number of places where the concept of  a "session" might apply in OIDC.

If ISAM is your OP, there will be a web session there when the user authenticates to access the /authorize endpoint.

If ISAM is your RP, there will be a web session there which is created when the incoming JWT is processed and exchanged for a SAM Credential.

A client might also use the Access/Refresh token acquired during SSO to make further API calls to endpoints protected by OP Access Manager (really this is now OAuth but closely related).  A session can be  created at WebSEAL for the OAuth client in this case - for performance.

Could you describe a little more about what you want to know?

Cheers... Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM