Set Persistent Cookie node
The Set Persistent Cookie node creates the specified persistent cookie on successful authentication.
The default persistent cookie is session-jwt.
The cookie contains a JWT with a JSON payload including information such as the UID of the identity, and the client IP address.
The node encrypts the payload of the JWT using the key pair defined
in the active secret mapped to the am.authentication.nodes.persistentcookie.encryption secret label.
If there isn’t a valid secret label mapping in a secret store, the node uses the key pair specified in the Persistent Cookie Encryption Certificate Alias property:
Find this property under Native Consoles > Access Management > Realms > Realm Name > Authentication > Settings > Security.
The node signs the cookie with the HMAC signing key defined in the node properties or the secret store with the mapped secret label. Configure nodes that read the persistent cookie such as the Persistent Cookie Decision node with the same HMAC signing key.
Example
Read the Persistent Cookie Decision node example.
Availability
| Product | Available? |
|---|---|
PingOne Advanced Identity Cloud |
Yes |
PingAM (self-managed) |
Yes |
Ping Identity Platform (self-managed) |
Yes |
Inputs
When the authentication tree completes successfully, the CreatePersistentCookieTreeHook treehook
for this node uses session properties to create the persistent cookie.
Dependencies
Make sure the user can successfully authenticate and get a session.
If this node is added to a no session journey or the noSession query parameter is used during authentication, the journey will fail.
Configuration
| Property | Usage | ||
|---|---|---|---|
Idle Timeout |
The maximum amount of idle time allowed before the persistent cookie is invalidated, in hours. If no requests are received before the timeout, the cookie is no longer valid. |
||
Max life |
The length of time the persistent cookie remains valid, in hours. After this time has passed, the cookie is no longer valid. |
||
Use Secure Cookie |
When enabled, adds the If the |
||
Use HTTP Only Cookie |
When enabled, adds the When the |
||
HMAC Signing Key |
A key to use for HMAC signing of the persistent cookie.
Values must be base64-encoded and at least 256 bits (32 bytes) long. To generate an HMAC signing key, run one of the following commands: or |
||
HMAC Signing Key Secret Label Identifier |
An identifier used to create a secret label for mapping to a secret in a secret store. Advanced Identity Cloud uses this identifier to create a specific secret label for the signing key for this node.
The secret label takes the form
If you set an HMAC Signing Key Secret Label Identifier and Advanced Identity Cloud finds a matching secret in a secret store, the HMAC Signing Key is ignored. If HMAC Signing Key is empty, Advanced Identity Cloud uses the value configured for
For greater security, you should rotate signing keys periodically. Learn more in Use ESVs for signing and encryption keys.
|
||
Persistent Cookie Name |
The name used for the persistent cookie. |