clearing jsessionid

[Former Member]

hi experts

we have a c# application with RSA security as front end.

RSA sso is implemented on businessobjects and it is working.

But the issue is, if the user1 logons in application and creates a session in infoview.

But he didn't logout infoview. when another user2 logons in the application on same computer.

Businessobjects still keeps the old session.

There is no way to tell tomcat to uses the new session.

I can see in CMC, there is two session active (user1 & user2).

Is it possible to clear jsessionid session & cookies?

Thanks!

Prasath

Edited by: Prasath Mungundu on May 13, 2010 11:13 PM

[ted_ueda · Accepted solution]

The jsessionid is a HTTP Session token generated by the Java Web Application Server itself to manage HTTP Sessions - here Tomcat.

Trying to eliminate jsessionid isn't a secure way to do things.

It's SSO, so the session will remain live till the HTTP Session times out, if the user hasn't logged off explicitly.

Sincerely,

Ted Ueda

[Former Member · Accepted solution]

Hi Ted

We are using RSA SSO and enterprise authentication, SSO works on initial login.

But when a user logs out, and logs back in to SSO without closing the browser, InfoView still holds the pervious session.

Is there a way to identify and get rid of tomcat session when new InfoView user comes in via SSO?

Is there some way to detect when the current user has changed, and remove the session accordingly.?

I have same question post in below thread.

Thanks!

Prasath

[ted_ueda · Accepted solution]

I'm assuming this isn't an issue if the user closes the web browser window before logon, since then the client-side won't try to re-send the cookies.

Sincerely,

Ted Ueda