Configure client-side sessions

PingOne Advanced Identity Cloud uses two types of tokens that represent an exchange of information, usually interactive, between PingOne Advanced Identity Cloud and a user or entity:

Authentication sessions, which PingOne Advanced Identity Cloud uses to manage authentication journeys before a user has authenticated successfully.
Sessions, which PingOne Advanced Identity Cloud creates after a user has authenticated successfully. Sessions let PingOne Advanced Identity Cloud manage the user’s or entity’s access to resources.

You can configure PingOne Advanced Identity Cloud to use client-side or server-side authentication sessions and sessions.

This page covers how to configure PingOne Advanced Identity Cloud to use client-side authentication sessions and sessions.

Client-side authentication sessions

Under Native Consoles > Access Management, go to Realms > Realm Name > Authentication > Settings.
Switch to the Trees tab.
From the Authentication session state management scheme drop-down list, select JWT.
In the Max duration (minutes) field, adjust the maximum life of the authentication session in minutes.
Save your changes.

When Advanced Identity Cloud creates tenant environments, it generates signing secrets: unique, secure, random values for signing authentication sessions.

To override the generated signing secret:

On the Authentication - Settings page, switch to the Security tab.

In the Organization Authentication Signing Secret field, enter a base64-encoded HMAC secret at least 128 bits long.

If you choose to override the generated signing secret, specify different values in your development, staging, and production tenant environments, so development sessions are not valid in your production environment, for example.

Save your changes.

Client-side sessions

Under Native Consoles > Access Management, go to Realms > Realm Name > Authentication > Settings.
Switch to the General tab.
Select Use Client-Side Sessions.
Save your changes.

Verify client-side sessions

The service does not track client-side sessions:

Authenticate to the realm configured for client-side sessions as a non-administrative user:

$ curl \
--request POST \
--header 'Content-Type: application/json' \
--header 'X-OpenAM-Username: <non-admin-username>' \
--header 'X-OpenAM-Password: <non-admin-password>' \
--header 'Accept-API-Version: resource=2.0, protocol=1.0' \
'https://<tenant-env-fqdn>/am/json/realms/root/realms/alpha/authenticate'
{
    "tokenId":"<token-id>",
    "successUrl": "/enduser/?realm=/alpha",
    "realm":"/alpha"
}

Under Native Consoles > Access Management, go to Realms > Realm Name > Identities > Username to find the user identifier at the top of the profile page; for example:
Go to Realms > Realm Name > Sessions.

With the user identifier, search for the session. You should find no sessions for the non-administrative user: