Web Agent Guides › Web Agent Configuration Guide › Single Sign-On Security Zones › Configure Security Zones › Specify the Single Sign-on Zone for the Agent

Specify the Single Sign-on Zone for the Agent

• SSOZoneName

  Specifies the (case-sensitive) name of the single sign-on security zone a Web Agent supports. The value of this parameter is prepended to the name of the cookie a Web Agent creates. This helps you associate cookies with their respective cookie domains. When this parameter is not empty, SiteMinder generates cookies using the following convention:

  ZonenameCookiename.

  Default: Empty (uses SM as a zone name, which gives the cookies the following default names):

  • SMSESSION
  • SMIDENTITY
  • SMDATA
  • SMTRYNO
  • SMCHALLENGE
  • SMONDENIEDREDIR

  Limits: Single-valued

  Example: Setting the value to Z1 creates the following cookies:

  • Z1SESSION
  • Z1IDENTITY
  • Z1DATA
  • Z1TRYNO
  • Z1CHALLENGE
  • Z1ONDENIEDREDIR

Use the SSOZoneName parameter to enter the name of the single sign-on zone a Web Agent is to support. This parameter is case sensitive. If not specified, it defaults to SM. If the value of the SSOZoneName parameter is non-empty, the Web Agent generates cookies with the naming convention:

zone_namecookie_name

where zone_name is the parameter value and cookie_name is the general name of the cookie being created.

Cookies affected by this convention include:

• SESSION
• IDENTITY
• DATA
• TRYNO
• CHALLENGE
• ONDENIEDREDIR

If the user is validated in a single sign-on zone in which that user has not yet established a session, the session specification returned by the Policy Server is used to create a new session cookie for that zone.

When a new cookie is created, its zone parameter is set to the zone name, in order to prevent the user from swapping cookies from different zones by simply renaming them. The cookie validation engine verifies if the zone name matches the prefix used in the cookie's name. This applies only to SESSION and IDENTITY cookies.

To specify the name of the single sign on zone you want the Web Agent to support, add the name of the zone to the SSOZoneName parameter.