Policy Server Guides › Policy Server Configuration Guide › User Sessions › User Session Overview › How SiteMinder Manages User Sessions

How SiteMinder Manages User Sessions

For the most part, SiteMinder manages user sessions automatically, performing a number of session management functions during the life cycle of a user session, as illustrated below.

• Session creation

  Establishing a session when a user successfully logs into an application. If a user fails to authenticate, no session is established.

• Session delegation

  Passing session information across an application environment. Delegating session information is necessary when an application's logic crosses several application tiers.

• Session validation

  Verifying the session ticket to make sure the user session is still active, that is, it has not expired or been terminated.

• Session termination

  Ending a user session when a user logs out, when the configured session timeouts expire, or when a user is manually disabled by the SiteMinder System Manager. When a user logs out or the user session expires, they must log in again to create a new session. In the case of manual user disablement, the user can not re-initiate a session.

The following diagram illustrates how SiteMinder manages a non-persistent session.

The following diagram illustrates how SiteMinder manages a persistent session.