...
Please refer to Checking for the existence of an active SSO session for information on various session status APIs that are front end based.
Please refer to Timeout configuration - SSO Timeout Configuration for wider information regarding session handling.
...
The session_index value cannot be used to retrieve user information, only for finding out if there is a valid session or not. Thus it is safer than passing an accecss token around.
Session status call format
The /uas/status endpoint takes the following query string parameters using a HTTP GET request:
...
Date and time formats: For JSON response NumericDate format is used - the number of seconds from 1970-01-01T00:00:00Z UTC until the specified UTC date/time, ignoring leap seconds. For XML dateTime format is used.
JSON Example
The following example is a request for client_id bv3ow90cv5bosicv4stlv0hrxk0bdmruu3ma with session_index _64343acbfe906c61da5acae54b333a1ef014d742:
| Code Block | ||||
|---|---|---|---|---|
| ||||
https://sso.example.com/uas/status?entityID=bv3ow90cv5bosicv4stlv0hrxk0bdmruu3ma&sessionIndex=_64343acbfe906c61da5acae54b333a1ef014d742 |
The response is by default in JSON format. Other formats are supported if sending the query parameter “type”
| Code Block | ||||
|---|---|---|---|---|
| ||||
https://sso.example.com/uas/status?entityID=bv3ow90cv5bosicv4stlv0hrxk0bdmruu3ma&sessionIndex=_64343acbfe906c61da5acae54b333a1ef014d742&type=application/json |
If a server session still exists, the message looks like this:
| Code Block | ||||
|---|---|---|---|---|
| ||||
{
"valid":true,
"issueInstant":1505991099671,
"refresh":false,
"entityID":"bv3ow90cv5bosicv4stlv0hrxk0bdmruu3ma",
"sessionIndex":"_64343acbfe906c61da5acae54b333a1ef014d742",
"sessionNotOnOrAfter":1505994469875,
"authnInstant":1505990869766
} |
The session can be refreshed with refresh parameter
| Code Block | ||||
|---|---|---|---|---|
| ||||
{
"valid":true,
"issueInstant":1505991139500,
"refresh":true,
"entityID":"bv3ow90cv5bosicv4stlv0hrxk0bdmruu3ma",
"sessionIndex":"_64343acbfe906c61da5acae54b333a1ef014d742",
"sessionNotOnOrAfter":1505994739500,
"authnInstant":1505990869766
} |
...
If there is no session or the entityID is invalid, the message looks like this:
| Code Block | ||||
|---|---|---|---|---|
| ||||
{
"valid":false,
"issueInstant":1495183121690
} |
XML Example
The following example is a request for client_id bv3ow90cv5bosicv4stlv0hrxk0bdmruu3ma with session_index _64343acbfe906c61da5acae54b333a1ef014d742:
| Code Block | ||||
|---|---|---|---|---|
| ||||
https://sso.example.com/uas/status?entityID=bv3ow90cv5bosicv4stlv0hrxk0bdmruu3ma&sessionIndex=_64343acbfe906c61da5acae54b333a1ef014d742&refresh=true&type=application/xml |
...
If a server session still exists, the message looks like this:
| Code Block | ||||
|---|---|---|---|---|
| ||||
<?xml version="1.0" encoding="utf-8"?> <status xmlns="http://schemas.ubisecure.com/uas/status"> <valid>true</valid> <issueInstant>2017-09-21T11:06:23.587Z</issueInstant> <refresh>true</refresh> <entityID>bv3ow90cv5bosicv4stlv0hrxk0bdmruu3ma</entityID> <sessionIndex>_64343acbfe906c61da5acae54b333a1ef014d742</sessionIndex> <sessionNotOnOrAfter>2017-09-21T12:06:23.587Z</sessionNotOnOrAfter> <authnInstant>2017-09-21T10:47:49.766Z</authnInstant> </status> |
In XML format. if there is no session or the entityID is invalid, the message looks like this:
| Code Block | ||||
|---|---|---|---|---|
| ||||
<?xml version="1.0" encoding="utf-8"?> <status xmlns="http://schemas.ubisecure.com/uas/status"> <valid>false</valid> <issueInstant>2017-09-21T11:08:15.114Z</issueInstant> </status> |
...