About the Infor OS Session ID Hint Tracking

Infor OS Session ID Hint Tracking adds session validation for Mongoose applications launched from the Infor OS Portal. When the application is loaded inside the Portal’s iframe, Mongoose validates the incoming Infor OS session ID against the active Mongoose session to ensure they match. If a mismatch is detected, the existing session is terminated to prevent unauthorized access.

This feature improves session management and strengthens Single Sign On (SSO) and Single Logout (SLO) integration for Mongoose-based applications running within the Infor OS Platform.

Who should use this

  • Cloud administrators managing Mongoose-based applications integrated with the Infor OS Portal.
  • Security teams responsible for session management and access control compliance.
Note: No customer action or uptake is required. This change takes effect automatically once the updated Mongoose code is deployed.

Key benefits

  • Prevents unauthorized session reuse - If a user’s Infor OS session is terminated, for example by logging out from the portal, Mongoose detects the mismatch and ends the application session, preventing stale sessions from remaining active.
  • Supports Single Logout (SLO) - When the SLO fails to fully terminate an application session, the session ID validation provides a secondary enforcement mechanism to ensure the session is closed on the next request.
  • Protects against shared URL access - If someone copies a raw WSWebClient URL from within the portal and shares it with another user, the session ID does not match the recipient's Infor OS session.
  • No customer configuration required - The feature activates automatically when Mongoose detects the Infor OS standard parameters in the request URL. No forms, settings, or configuration changes are required.
  • No effect to external or standalone users - Existing session behavior remains unchanged for applications launched outside the Infor OS Portal, including Designer standalone, external entity URLs, and direct bookmarks without portal parameters.

Prerequisites

  • Infor OS Portal version 2024.07 or later - Required for the portal to include the inforTenatID and inofrSessionID standard parameters in the iframe URL.
  • Mongoose version 2026.10 or later - Contains the session validation implementation.

How it works

Portal standard parameters

When Mongoose is launched from the Infor OS Portal, the Portal includes two query parameters in the iframe URL:

Parameter Description
inforTenantId The tenant ID value.
inforSessionId A unique ID from Infor OS that manages the user session; deleted when the user logs out or the session expires

Session validation flow

  1. On load, Mongoose checks whether the query string contains both inforSessionId and inforTenatId parameters.
  2. If one of the parameter is missing, the query string validation is skipped and the request continues normally.
  3. When both parameters are present, Mongoose retrieves the corresponding values from the SSO token claims, http://schemas.infor.com/claims/SessionId and http://schemas.infor.com/claims/Tenant, and compares them with the inforSessionId and inforTenantId query string values.
  4. If both query string values are non-empty and match their corresponding claims, the application loads normally.
  5. If either value is missing or does not match its corresponding claim, Mongoose abandons the session, signs out from the WIF SessionAuthenticationModule if present, and redirects the user to the login page for web client. For widgets, the same process applies; however, the session is automatically re-established afterward.

When validation fails

When a mismatch is detected, the session is abandoned and signed out from the WIF or the Windows Identity Foundation which is the .NET framework component that manages the federated/SSO authentication session with the identity provider.

In the web client, it redirects to the Mongoose login page, so the correct user or session can log in.

In the Widgets, the session is re-established automatically with the correct logged-in user or session.

Fallback behavior

If the inforTenantId and inforSessionId parameters are not present in the URL, Mongoose assumes the application is running outside the Infor OS Portal and uses its default session handling. No session ID validation is performed.

Affected application areas

Area Behavior
WSWebClient (runtime) Session validation enforced when portal parameters are present
Widgets Session validation enforced. The resolve(key) method is used on the IWidgetContext to receive the parameters in the iframe URL.

Unaffected applications

  • Standalone desktop application - Not launched from the portal; no parameters are present.
  • Web Designer - Not launched within the portal. no session parameters are present in the URL. Validation is not enforced.
  • Report Viewer - Not launched within the portal. no session parameters are present in the URL. Validation is not enforced.
  • External entity users - Receive Mongoose URLs without portal parameters.
  • Direct bookmarks without portal parameters - fallback to the existing session behavior, no validation.