Last update:
Session management
Aug 21, 2026
Aikyam manages user sessions using encrypted session cookies and a centralized session store. The platform is designed for multi-tenancy, logical isolation, and secure, scalable session handling across hundreds of applications (relying parties) under different tenants.
Let’s start with the basics of how sessions are handled in Aikyam.
- User sessions are managed using encrypted cookies and a centralized session store.
- The platform supports multi-tenancy, logical isolation, and secure session handling for hundreds of applications (relying parties).
How sessions work
Here’s what happens behind the scenes when a user interacts with Aikyam.
- Session Cookie (ODP Cookie): Every user request sets a session cookie containing an encrypted context ID. This ID maps to session state in Redis.
- On first request, a new cookie is set if none exists.
- After authentication, the cookie is replaced to track the authenticated session.
- Session Store: Redis acts as the session store, mapping session states to context IDs.
- Session expiry is managed via TTL (time-to-live) on Redis entries.
- Multiple session types exist (auth, user, gateway, OIDC), but a new unified global user state is in development.
- Session Reuse: Authenticated sessions can be reused across applications (RPs) within the same tenant, unless an RP’s policy requires re-authentication.
- Session Lifecycle:
- Created on first page load.
- Updated after authentication.
- Invalidated when TTL expires or on logout.
Security and isolation
Aikyam’s architecture ensures sessions are secure and isolated.
- Stateless Services: Most microservices are stateless; session state is managed by the gateway.
- Services may read or rarely mutate session state, but don’t store session data in their own databases.
- Tenant Isolation: Each tenant is logically isolated. Session data is scoped by tenant ID, preventing cross-tenant data access.
- Access Controls: Planned upgrades will introduce a state service for granular security controls, defining which services can read or modify session data.
Previous:
Manage password policies
Next:
Adaptive authentication
Share additional feedback to help us improve.
0/255
|
Powered by Aikyam @2025 All rights reserved
+1 866 451 2735
+1 866 451 2735
+1 855 819 5909