Hi there,
While we had WDJava applications integrated into the portal, the logoff from the portal used the SessionReleaseAgent to close sessions on the backend. So logging off from the Portal also sent logoffs to integrated third WDJ-systems.
Now we have an intranet based on some third party WCMS, and the WDJ-applications are still integrated within iFrames. We have one central SAP system creating MYSAPSSO2 cookies, which then redirects to one of the integrated WDJ servers. When UserA logs off, we destroy the MYSAPSSO2 Cookie and the security session on the central cookie issuing system.
If the browser does not get closed and UserB logs in and navigates to the integrated WDJ application, he sees the data of UserA; he got a new MYSAPSSO2 cookie from the central issuing system, but the third WDJ server does not check this, as the JSESSIONID cookie still is in place.
Question: Any idea about an easy workaround on this situation? Of course, technically there are only two main approaches - destroying the security session on the third party WDJ server(s) or destroying the JSESSIONID cookie(s). The latter is not trivial, as the third party server might be in domain a.b.x.y whereas the intranet is i.x.y, for example. So, if anyone has done this before or has got a good design idea how to implement this...
Thanks in advance
Detlev
PS: For any design, keep two restrictions in mind: We have no possibility to deploy anything on the third party WDJ servers; and we do not necessarily know which servers are integrated - editors might just use the WCMS to integrate one more WDJ system of which we do not know before. Anyhow, technically we have an application-page in the WCMS which has to be used (so we could implement logic there, on server as on client side), and we have the central ticket issuing system, which gets aware of the integrated URLs; if this helps...