Policy Server Guides › Policy Design Guide › User Sessions › User Session Overview › Session Tickets

Session Tickets

SiteMinder implements session management using session tickets. A session ticket contains basic information about a user and that user’s authentication information; it is used to identify the user’s session across all sites in a single sign-on SiteMinder environment. Session tickets are encrypted and can only be read/validated by the Policy Server. SiteMinder Web Agents use session tickets to identify users and provide session information to the Policy Server.

The session ticket is handled differently depending upon whether the session is persistent or non-persistent.

Note: Non-persistent and persistent cookies are unrelated to the user’s SiteMinder session being non-persistent or persistent.

Non–persistent session

The Web Agent places the session ticket in a cookie. The cookie contains the user session data; no user-specific data is kept in the cookie itself. The Web Agent is responsible for validating the cookie and enforcing session timeouts.

Persistent Session

The Web Agent places the session ticket in a session server database and, if possible, in an optional cookie on the client.

The session ticket data is used as an index into the Web Agent’s cache, which contains the user session data. If a cookie is written, no user-specific data is kept in the cookie itself. The Web Agent is responsible for validating the session and enforcing the session timeouts.