Microsoft KB Archive Search

Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

  1. Home
  2. FIX: The NLSessionStrunknamePersistForOffice cookie domain that is generated by Forefront Unified Access Gateway 2010 is set to "host.domain.com" instead of to "domain.com"

FIX: The NLSessionStrunknamePersistForOffice cookie domain that is generated by Forefront Unified Access Gateway 2010 is set to "host.domain.com" instead of to "domain.com"

View products that this article applies to.

Symptoms

Consider the following scenario:
  • You publish Microsoft Office SharePoint Server 2007 or Microsoft SharePoint Server 2010 by using Microsoft Forefront Unified Access Gateway (UAG) 2010.
  • You log on to the trunk from a client computer and then access the SharePoint application.
  • You access an Office document from a SharePoint document library.

In this scenario, the NLSessionStrunknamePersistForOffice cookie domain that is generated by Forefront UAG is set to "host.domain.com" instead of to "domain.com."

Note In certain logoff customization scenarios, this behavior may cause trunk logoff not to complete successfully.

↑ Back to the top

Cause

This problem occurs because the InternalSiteSharePoint.inc hook incorrectly uses the TrunkDomain parameter instead of the DomainBasedCookie parameter.

↑ Back to the top

Resolution

To resolve this problem, install the service pack that is described in the following Microsoft Knowledge Base article:
2710791 Description of Service Pack 2 for Forefront Unified Access Gateway 2010

↑ Back to the top

Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

↑ Back to the top

More Information

The NLSessionStrunknamePersistForOffice cookie is used in SharePoint Office integration scenarios. The domain attribute of this cookie can be viewed by using either F12 developer tools for Internet Explorer 9 or some third-party web debugging tools.

Some Forefront UAG trunk logoff customizations rely on an external server that uses the same domain suffix as the trunk's public host name to invalidate all the relevant cookies in order to complete the logoff process. Those customizations may be affected by this problem. Although other Forefront UAG cookies may be invalidated by that external server, the NLSessionStrunknamePersistForOffice cookie is never sent to the external server because it is a host cookie instead of a domain cookie. Therefore, the external server cannot invalidate this cookie. Then, when another request is made to the published SharePoint application, the NLSessionStrunknamePersistForOffice cookie is presented to the Forefront UAG server. The server considers this to be a valid ongoing session request and continues to give access.

↑ Back to the top

References

For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:
824684 Description of the standard terminology that is used to describe Microsoft software updates

↑ Back to the top

Keywords: kbqfe, kbfix, kbnotautohotfix, kbexpertiseinter, kbbug, kbsurveynew, kb

↑ Back to the top

Article Info
Article ID : 2697696
Revision : 1
Created on : 1/7/2017
Published on : 12/7/2012
Exists online : False
Views : 250