Large Session Cookie Size When Using OAuth Login in Identity Manager (4383886)

When logging in to the Angular Portal using OAuth (e.g., ADFS), the browser rejects the Set-Cookie header with an error:

The combined size of the name and value must be less than or equal to 4096 characters.

This happens because the imx-session-* cookie becomes too large.

The imx-session-* cookie stores an encrypted session token.

With OAuth login, this token includes:

• All claims from the identity provider (ADFS)
• The full token content (e.g., ID token, possibly access token)
• Additional session and security data
• Encryption and signing overhead

Even if the claims list looks small, the encoded and signed token becomes much larger.

Identity Manager does not filter or reduce claims, so everything provided by ADFS is stored in the session cookie.

Reduce the size of the token on the ADFS side:

• Remove unnecessary or duplicate claims
• Avoid sending both OIDC and WS-Fed style claims
• Only include required attributes
• Simplify token content where possible

There is no configuration in Identity Manager 9.2.x to reduce cookie size or move session data out of the cookie.

The recommended approach is to minimize the token payload from the identity provider.