KB484692: "Error in login Please contact your Administrator" is returned intermittently in Chrome when accessing MicroStrategy Web with SAML enabled

Description 

The following error is experienced intermittently in Chrome when accessing Strategy Web with SAML enabled.
Error in login
Please contact your Administrator. 
 

You can further troubleshoot this issue: 
 

• SAML Log: To get more detailed information, you can edit

  log4j.properties

  under

  <Strategy Web Application>/WEB-INF/classes

  and set all the log levels to DEBUG. Restart the web application server after making the change. Please remember to change the log level back to ERROR after troubleshooting. 
  With the scenario reproduced, you can see the following exceptions in the SAML log:
  

  09/15/2020 09:08:24,070 org.springframework.security.saml.storage.HttpSessionStorage DEBUG - Message a2cac57i68ha2ij92190ebhf3cd3c40 not found in session 5D65B46C47B5C3356701BDB7D45E229F 09/15/2020 09:08:24,070 org.springframework.security.saml.SAMLAuthenticationProvider DEBUG - Error validating SAML message org.opensaml.common.SAMLException: InResponseToField of the Response doesn't correspond to sent message a2cac57i68ha2ij92190ebhf3cd3c40

  
  
• Fiddler log: From the fiddler log, you can that

  JSESSIONID

  was lost and a new

  JSESSIONID 5D65B46C47B5C3356701BDB7D45E229F

  was created when sending the request, 

  POST /MicroStrategy/saml/SSO

  .
  

• Additionally, from the above screenshot taken from the fiddler log, the SameSite cookie attribute is not set for

  JESESSIONID.

Why is this happening?

Since Chrome 80, if the SameSite cookie attribute is not configured, it will be set to “Lax” by default. SAML configured with SP initiated POST Binding is affected if the Strategy application servers are in a different domain from the SAML authentication Identity Provider domain.

Solution

Refer to the steps in Chrome v80 Cookie Behavior and the Impact on MicroStrategy Deployments.