SharePoint 2013, Two Web Applications and Persistent Cookie, looping issue

Question

In our environment we are having a looping issue.

Scenario:

WebApp1 (https://webapp1)

WebApp2 (https://webapp2)

Clients using IE11

Claims Authentication - Using a Trusted Identity Provider (OpenAM)

User accesses WebApp2, a persistent cookie for WebApp2 is created and is stored on the client's local machine. Network trace shows the fedauth cookie contents for WebApp2 is being passed and access granted.

User then accesses WebApp1, a persistent cookie for WebApp1 is created and stored on the client's local machine. Network trace shows the fedauth cookie contents for WebApp1 and WebApp2 is being passed and access granted.

Now the persistent cookie for WebApp2 expires or is deleted. User then attempts to access WebApp2 again, the IE browser will then show looping between OpenAM and SharePoint, in the network trace it shows that at the GET request the cookie being sent contains only the fedauth cookie for WebApp1. From this it looks like SharePoint takes the cookie and checks if it is for WebApp2, confirms that it is not the correct cookie and sends it back to OpenAM and then the loop starts.

Using Chrome this all works perfectly. So the part i want to know, does this sound like an issue with the trusted identity issuer(OpenAM) or the browser? Or a combination?

Answer 1

Discovered the cause. If the cookie does not contain the domain attribute it will pass the root domain cookie to the sub domain, in the above scenario (adding a domain)

WebApp1 (webapp1.domain)

WebApp2 (other.webapp1.domain)

So when WebApp2 cookie expires IE will send in its request header the WebApp1 fedauth cookie, this is sent to the STS and is rejected as the cookie / fedauth is not matching and thus the loop. You can see this in the network trace (IE developer tools)

References below:

http://erik.io/blog/2014/03/04/definitive-guide-to-cookie-domains/