Though this is when things go wrong. When you successfully authenticate, your browser throws a big wobble by stating that you've made too many redirects (ERR_TOO_MANY_REDIRECTS). Your localhost_access_log.txt will indicate that multiple 302 requests are returning back to the application. Basically the application that you're trying to access is not accepting the OpenAM cookie (or at least doesn't acknowledge a valid one) The application sends the browser to OpenAM for you to authenticate. OpenAM however acknowledges that you have an active session (and an active domain cookie) and basically says, 'Do don't need to auth again, you already have a valid token, go back to the application'.

An simple example is that the application 'app1.bus1.com' resides on a separate domain of OpenAM '.business1.com' and therefore the domain cookie differs.

Get a tracer. Chrome's plugin SAML tracer. cookie inspector

ForgeRock has a functionality called cross-domain single sign on (CDSSO). Basically it will allow OpenAM to create a cookie to access different DNS domains to where OpenAM is deployed. So even though you're accessing app1.bus1.com, the policy agent will extract the SSOToken from LARES and sets the cookie domain to the FQDN of the resource, which is pretty cool!

To the material in question is, HOW TO: Enable CDSSO For a Java EE Policy Agent Obviously this is different for just web policy agents though the same document provides both just incase the page is unavailable, perform the following tasks

• In the OpenAM console, browse to Access Control > Realm Name > Agents > Web > Agent Name > SSO.
• Enable Cross Domain SSO.
• Set the list of URLs for CDSSO Servlet URL to the Cross Domain Controller Servlet URLs of the servers the agent accesses, such as http://openam.example.com:8080/openam/cdcservlet. If the agent accesses OpenAM through a load balancer, use the load balancer URLs, such as http://load-balancer.example.com:8080/openam/cdcservlet.
• Add the domains involved in CDSSO in the Cookies Domain List.
• If necessary, update the Agent Root URL for CDSSO list on the Global tab page. If the policy agent is on a server with virtual host names, add the virtual host URLs to the list. If the policy agent is behind a load balancer, add the load balancer URL to the list.
• Save your work.

About the author