This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Web SSO - v802

smmellac over 5 years ago

Trying to test SSO connectivity after upgrading to v8.0.2. Made the following changes

- Authn module - Active directory user account (role based)

- Updated the QER\WebPortal\BaseURL

Below is the error i see in the logs

2018-12-11 09:45:41.2555 INFO ( WebLog gfbbddew5mfu1vshzf4no0an) : Module instance created: VI_Session

2018-12-11 09:45:41.2711 INFO ( WebLog gfbbddew5mfu1vshzf4no0an) : Session gfbbddew5mfu1vshzf4no0an started

2018-12-11 09:45:41.2711 INFO ( WebLog gfbbddew5mfu1vshzf4no0an) : Authenticating session using RoleBasedADSAccount

2018-12-11 09:45:42.3024 WARN ( WebLog gfbbddew5mfu1vshzf4no0an) : System.Exception: Single-sign-on failed, URL was /IdentityManager/ ---> System.AggregateException: One or more errors occurred. ---> VI.Base.ViException: Failed to authenticate user. ---> VI.Base.ViException: The current user could not be determined.

Checked F5 logs as well and it seems like the servers are not even attempting to hit F5 configured URL

Please advise

Top Replies

Parents

0 Troy Grandy over 5 years ago

Can you confirm that an employee is linked to this Active Directory account? Also they will need a role
Cancel
Up +1 Down

Cancel
0 smmellac over 5 years ago in reply to Troy Grandy

Employee is linked to AD account. Is there a specific role they need in 1IM?
Cancel
Up 0 Down

Cancel
0 Markus Weiss-Ehlers over 5 years ago in reply to smmellac

Did you try to turn off basic authentication? So, only Windows Authentication is enabled.

Did you check the IIS logs to see what user is trying to access the IdentityManager URL?

Are you using a direct database connection in the web portal or an Application Server connection?
Cancel
Up 0 Down

Cancel
0 smmellac over 5 years ago in reply to Markus Weiss-Ehlers

Turning off basic auth did not help. We are going through the appserver not directly to the DB. Is there a way to remove configured appserver in webportal (other than uninstalling appserver) to try if SSO works without going through appserver?
Cancel
Up 0 Down

Cancel
0 Troy Grandy over 5 years ago in reply to smmellac

WebDesigner.ConfigFileEditor is the place to change this see screen shot below:
Cancel
Up +1 Down

Cancel
0 smmellac over 5 years ago in reply to Troy Grandy

I can change it to a different appserver but cant have no app server using WebDesigner.ConfigFileEditor. Am i missing something?
Cancel
Up 0 Down

Cancel
0 Troy Grandy over 5 years ago in reply to smmellac

Are you clicking on Enter new connection under the Connection section? It sounds like your trying to update the Search service.
Cancel
Up 0 Down

Cancel
0 smmellac over 5 years ago in reply to Troy Grandy

Even from enter new connection when i click on APpServer it's asking me to put a URL. If i have a null value, it's not getting updated
Cancel
Up 0 Down

Cancel
0 Troy Grandy over 5 years ago in reply to smmellac

We would like you to use a SQL connection instead of using Application Server. Please choose SQL Server and complete the connection details. Once completed please test to see if the site now works with SSO
Cancel
Up 0 Down

Cancel
0 smmellac over 5 years ago in reply to Troy Grandy

Updated SQL connection info and tried...did not work. Unisntalled app server and tried with https://<servername>/IdentityManager.

No luck. Let me know if i need to raise an SR for this
Cancel
Up 0 Down

Cancel
0 Markus Weiss-Ehlers over 5 years ago in reply to smmellac

Is the server a domain member?

Did you check the IIS log (not the one from the Web Portal) to check if the request contains Windows credentials?
Cancel
Up 0 Down

Cancel
0 smmellac over 5 years ago in reply to Markus Weiss-Ehlers

The server is a member of the domain. I dont see the users credentials in the IIS log
Cancel
Up 0 Down

Cancel

Reply

0 smmellac over 5 years ago in reply to Markus Weiss-Ehlers

The server is a member of the domain. I dont see the users credentials in the IIS log
Cancel
Up 0 Down

Cancel

Children

0 Markus Weiss-Ehlers over 5 years ago in reply to smmellac

There you have it. If the IIS is unable to detect the username accessing it, OneIM cannot use this information as well.

Did you try to access the portal using a non-MS browser like Chrome or Firefox? Does it ask you for Windows credentials (assuming you haven't configured these browsers to use integrated auth explicitly)?
Cancel
Up 0 Down

Cancel