ADSF Citation - NSFM - LTPAToken2 SameSite=Strict causing NOI/Jazz UI failures in Hybrid Domain Deployments on 1.6.14 version.

As per bank security policy, the LTPAToken2 response cookie must have SameSite attribute set to Strict across all environments. However, enabling this configuration in NOI 1.6.14 leads to functional failures in hybrid and cross-domain deployments.

Current Configuration & Constraints

Product: NOI 1.6.14
Cookie impacted: LTPAToken2
Required policy: SameSite=Strict
Jazz Console domain: *.bankofamerica.com
NOI Console domain: *.bofa.com
WAS setting tested:
com.ibm.websphere.security.addSameSiteAttributeToCookie=Strict
NOI common-ui deployment cookie configuration also set to Strict

Observed Behavior

When SameSite is set to Strict:

Accessing NOI or Jazz Alerts/Topology/CNEA Policy pages fails
Error Observed:
Error 404: SRVE0190E: File not found: /
This occurs consistently across environments

When SameSite is set to None:

Cross-domain hybrid deployment works as expected.
However, this violates bank security policy and is not acceptable for production use.

Why is this useful ?

This  proposal is useful because it resolves a direct conflict between enterprise security policy and NOI product behavior.

Key value:

• Enables compliance with strict banking security standards
• SameSite=Strict is mandatory to prevent cross-site cookie leakage and session hijacking.
• Prevents production outages
• Current behavior breaks NOI and Jazz UI (404 / SRVE0190E errors).
• Avoid insecure workarounds
• Setting SameSite to None or Lax is not acceptable in regulated environments.

Who would benefit from this ?

Primary beneficiaries

     Banks & Regulated Enterprises

• Cannot relax SameSite or cookie scoping
• Often use multiple domains/subdomains for operational and legal reasons.

Security & Risk Teams

• Eliminates risk of:
• Session fixation
• Cross domain cookie leakage
• Unauthorized access via sibling applications

How should it work ?
Goal: SameSite cookie attribute should be set to Strict to remediate the risk as per bank policies.

For more details please go through the following documentation -> https://www.ibm.com/support/pages/netcool-operations-insight-hybrid-deployment-console-integration-definitions-asm-exist-are-blank-deployment-where-noi-cluster-and-prem-domains-are-different?view=full

• Minimal security risk
• Works with SameSite=Strict
• Fully compliant
• UI navigation does not rely on cross-domain redirects that require cookies.

Why Current behavior fails ?

NOI/Jazz UI implicitly expects:

Cookies to be sent across domains
SameSite is not Strict

When Strict is enforced:

Session breaks
UI fails with 404 / SRVE0190E
Cookies are dropped by the browser

Existing IBM PMR Case Numbers:

TS018143558
TS019031795