SYMPTOM:
The following error is encountered upon login in Web after Single Sign-On has been implemented:
Sample Code/Error
The Web Server encountered an unknown runtime error.
(User is not found.User is not found.You don’t have permission to connect to this server, please contact your server administrator.)
Consider the scenario where the user ID to log into Site Minder is ‘111’.
In the Authentication trace, two separate entries are logged for two different user ID’s as below:
2010-11-19 16:55:20.549-05:00 Login using Simple Security Plug In with User ID='222'
2010-11-19 16:55:21.127-05:00 Logout
2010-11-19 16:55:47.034-05:00 Login using Simple Security Plug In with User ID='111'
2010-11-19 16:55:47.128-05:00 Logout
CAUSE:
Web Server is the one that talks to Site Minder and interprets the validation token. It then passes the user name to the Strategy Intelligence Server, which trusts this implicitly because it’s been setup to trust the web server.
In this case, Web Server passes the user name stored in the variable ‘SM_UNIVERSALID’. However, the correct user name is
stored in the variable ‘SM_USER’. This can be seen below in the report from Site Minder showing its headers.
HTTP_SM_UNIVERSALID:467344 <-- This is the value MSTR Web is using
HTTP_SM_AUTHDIROID:0e-b3be9993-ea6d-102b-bf8a-83e0944b304d
HTTP_SM_AUTHDIRNAME:USERSTORE
HTTP_SM_AUTHDIRSERVER:172.24.889.234:4294 172.78.343.165:2394
HTTP_SM_AUTHDIRNAMESPACE:LDAP:
HTTP_SM_USER:1016974 <-- This is the correct ID that should be used
ACTION:
By default Strategy uses SM_USERDN for the distinguished name and SM_UNIVERSALID for the user name. By using the Customizations Editor, the default values for the Site Minder headers can be easily changed.
To change these default parameters, follow the instructions provided in the MSL in the following location:
Start-> Programs-> Strategy-> SDK-> Developer Library->Web SDK-> Single Sign-On-> Scenarios-> Changing the Default Settings for SiteMinder.
As the ‘siteminder_security.properties’ is edited, both the headers SM_UNIVERSALID and SM_USER are listed. Strategy offers the possibility by default to have either of these variables, but if both are found, SM_UNIVERID will take precedence over SM_USER since it was defined first.
In this scenario, since the correct user ID is stored in the ‘SM_USER’ variable, just delete the ‘SM_UNIVERSALID’ variable. Save and close and restart the Web Server.
Make sure the ‘Trust Authentication’ section for the user is filled with the appropriate validation token from Site Minder. This will link the Site Minder user to the appropriate Strategy user.
Note: Also make sure the user has browse rights to the ServerDef object by following the steps below:
Right-click on the Project Source and browse to Strategy Intelligence Server Configuration-> General-> Modify-> Security.
KB10819
