I develop a lot of internal applications/websites for my work using our standard SSO. It uses SAML2 and has a few different levels of security available.

We have vendor who is using it for one of our internal CMSs. Basically you have to sign into SSO every day to access the site. You are just required to meet SSO authentication once per browser for almost all of the internal sites (the highest level ones require new authentication every time). The vendor/CMS is not at this level though, it just has basic SSO authentication.

So I make some config changes to vendor site and propagate them over the weekend. I need to check the changes on a bunch of different browsers. FF, Chrome, IE8, IE11, Safari, Android, Blackberry, Iphone...

I had to log into SSO each time... Until I try my iphone. I go to website and no redirect to SSO, I just get right in. I hadn't logged into the site on iphone in over a week. How could the iphone be passing back an authenticated cookie to the SSO?

  • Do you have any syncing between your phone and other devices? Did you click the "Remember me" option?
    – Ohnana
    Feb 23 '15 at 18:31
  • @Ohnana - remember me on site or iphone... No and I don't know. It should all be the same though.
    – blankip
    Feb 23 '15 at 19:26
  • Okay, I figured I'd eliminate the "dumb" answers first. Very puzzling.
    – Ohnana
    Feb 23 '15 at 19:28

SSO architecture has layers to it, we can usually break these out into two main components: - The Identity Provider (IdP) sessions. - The Service Provider (SP) session.

Each of these sessions will usually be preserved in the browser as a cookie, as you state above. The IdP session is usually the "key" to SSO, and has a set expiration date. However, in some architectures the SP issues its own session after a successful assertion from the Identity Provider. This SP session can be independent of the IdP session, and the SP may not check with the IdP for staleness of the session.

So, I don't think you have an actual SSO session. I believe you have a session with this specific SP you were testing against. If you clear your iPhone history/cookies/cache completely, this should certainly not work. The root cause is likely that the SP does not expire sessions, and the issued session is long lived and sitting in the iPhone browser cookie jar. I suspect your other browsers have cleared the session when closing the browser.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.