Policy Server Guides › Policy Design Guide › User Sessions › User Session Overview › How SiteMinder Manages User Sessions

How SiteMinder Manages User Sessions

For the most part, SiteMinder manages user sessions automatically, performing a number of session management functions during the life cycle of a user session, as illustrated below.

Session creation

Establishing a session when a user successfully logs into an application. If a user fails to authenticate, no session is established.

Session delegation

Passing session information across an application environment. Delegating session information is necessary when an application’s logic crosses several application tiers.

Session validation

Verifying the session ticket to make sure the user session is still active, that is, it has not expired or been terminated.

Session termination

Ending a user session when a user logs out, when the configured session timeouts expire, or when a user is manually disabled by the SiteMinder System Manager. When a user logs out or the user session expires, they must log in again to create a new session. In the case of manual user disablement, the user can not re-initiate a session.

The following diagram illustrates how SiteMinder manages a non-persistent session.

The following diagram illustrates how SiteMinder manages a persistent session.