7

We have a custom SSO implementation that we are using to secure the SDL Web 8 CME. For the most part it is working quite well.

However, for understandable security reasons our SSO provider needs to re-authenticate after a period of X hours. We can set X to anything we like, but it can't be infinity.

Some of our users leave their browser with the SDL Web 8 GUI open all week/month. If they leave it open longer than 'X', then the GUI stops responding (and we start getting errors in the notification box of the CME). This is to be expected as the SSO authentication module ends up throwing 401 unauthorized responses on all requests to the CME (and accompanying services). Refreshing the browser takes them to the SSO login page, and they can log in again. However this is not very intuitive, and our users get confused by the errors.

To prevent this I would like to force the browser to redirect after a period of Y hours and send the user to our SSO login page. This way I could force them to login again before the time out occurs. It would also limit the security risk of users leaving their browsers open with a CME that can change our live websites.

I understand we should tell our users to close their browser at the end of the day, but this is not a realistic solution.

Does anyone have any suggestions or examples on how I can redirect a user in the CME to a specific external URL after a period of 'Y' hours. An even better solution might be if the GUI ever receives a 401, instead of outputting it in the notification area, it could redirect the whole browser to my SSO page.

SIDE NOTE: Unfortunately Alchemy does not work with our SSO implementation right now, so we won't be able to use an Alchemy extension for this.

Improve this question
3
  • I know it can be done via JS. I can't post the exact solution but could probably guide you if you have some issues pursuing that approach.
    – Warner Soditus
    Commented Jul 15, 2016 at 14:02
  • any suggestion which files or views I might extend or edit?
    – Chris Summers
    Commented Jul 19, 2016 at 18:43
  • I took a look at our implementation... what we have is a custom JS file that provides an alert that the session has expired. the actual session timeout is implemented within the Siteminder configuration. sorry for leading you wrong initially.
    – Warner Soditus
    Commented Jul 21, 2016 at 13:43

1 Answer 1

Reset to default
5
+50

There will be two step process:

  1. Create javascript file which can detect idle time. Refer following link for this implementation: Detect idle time in javascript
  2. Load this javascript in tridion. Refer following link for this implementation: Load javascript file without any GUI references

When idle time goes beyond the limit that you specified, you can peform redirect using javascript / jquery to the login page.

Improve this answer
1
  • Good stuff. Will try this later this week.
    – Chris Summers
    Commented Jul 19, 2016 at 19:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.