Question

Will OpenAM work if cookies are disabled?

I have a Flex application and on some browsers (Chrome, Firefox), when a file upload is attempted, the flash player will not pass the OpenAM cookie. I need to find another way to do this. Is there any way to use OpenAM when cookies are disabled?

Answer 1

Not by default, but you may be able to modify the OpenAM source code to do so.

From the OpenAM mailing list:

if you check out the source code of
SSOProviderImpl#createSSOToken(HttpServletRequest) it looks like there
are methods trying to get the session id from the request
parametermap, so IMHO you should be able to post the
cookiename=cookievalue along with your file, or put the session ID on
the querystring (but that will be logged in the container access
logs…)