KB440621: "Authentication statement is too old" error prevents users from logging into MicroStrategy using SAML after the session times out

Description

Users are able to log in correctly using SAML into Strategy Web / Library / Mobile. However, after a period of inactivity causing the web server session to time out, the user attempt to log into Strategy again and SAML authentication fail with the following error on the interface:

"Error in login"

Please contact your administrator

The error on the interface is generic. When reviewing the SAML log, the following error is logged during processing of the SAML response assertion:

​Caused by: org.springframework.security.authentication.CredentialsExpiredException: Authentication statement is too old to be used with value "timestamp"

Why is this happening?

The Identity Provider (IDP) is re-using information that the user has authenticated earlier (indicated by the "Authentication Instant" in the SAML response) and, by default, Spring SAML is configured to prevent users from login if the authentication instant is older than 7200 seconds. More precisely, the web server session has expired and therefore, the Service Provider (SP), here Strategy Web / Library / Mobile, issues a new SAML authentication request and redirects the user to the IDP in order to retrieve a new SAML assertion. The IDP assertion is still valid, and therefore the IDP returns a new SAML response though with the original authentication instant - which is too old for the default configuration of Spring SAML.

Solution

Increase the 

maxAuthenticationAge

 to be equal to or larger than the assertion validity time of the IDP.

Strategy Web / Mobile

1. Open SpringSAMLconfig.xml from [Web_Deployment_Folder]\WEB-INF\classes\resources\SAML
2. Find the following entry:
   

   
   <bean id="webSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerImpl"/>
   

   
   
3. Add the

   maxAuthenticationAge

   as follows and adjust the value (seconds) to the assertion validity time of your Identity Provider:
   

   
   <bean id="webSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerImpl"> 
   <property name="maxAuthenticationAge" value="xxx"/>  
   </bean>

   
   
4. Save the file and restart the Web server.

Strategy Library 10.9/10.10

1. Locate 

   restful-api-1.0-SNAPSHOT-jar-with-dependencies.jar

    in the 

   WEB-INF/lib

    of the Strategy Library file directory.
2. Find 

   SpringSAMLConfig.xml

    at 

   auth/SAML

    inside the jar.
3. Copy the file and place it in 

   WEB-INF/classes/auth/SAML

    with your other SAML configuration files. Now any modification of the file will take precedence over the original file inside the jar.
4. Open SpringSAMLconfig.xml from [Web_Deployment_Folder]/WEB-INF/classes/auth/SAML.
5. Find the following entry:
   

   
   <bean id="webSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerImpl"> 
   </bean>

   
   
6. Add the maxAuthenticationAge as follows and adjust the value (seconds) to the assertion validity time of your Identity Provider:
   

   
   <bean id="webSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerImpl"> 
   <property name="maxAuthenticationAge" value="xxx"/>  
   </bean>

   
   
7. Save the file and restart the Web server.

Strategy Library 10.11

1. Download and install the third-party tool, WinRar .
2. Go to

   \MicroStrategyLibrary\WEB-INF\lib.

3. Locate the restful-api-1.0-SNAPSHOT-jar-with-dependencies.jar file.
4. Using WinRar, open

   restful-api-1.0-SNAPSHOT-jar-with-dependencies.jar.

5. In 

   restful-api-1.0-SNAPSHOT-jar-with-dependencies.jar

   , navigate to

   auth/custom.

6. Locate

   SAMLConfig.xml.

7. Drag

   SAMLConfig.xml

   to your desktop to extract it from the jar file.
8. Open

   SAMLConfig.xml

   in a text editor.
9. Above the

   <beans/>

   closing tag (last line), paste the code:
   

   
   <bean id="webSSOprofileConsumer" class="org.springframework.security.saml.websso.WebSSOProfileConsumerImpl"> 
   <property name="maxAuthenticationAge" value="xxx"/>  
   </bean>
   

   
   
10. In the pasted code, change the

    value

    parameter to contain the actual authentication age in seconds. For example, use

    value="3600"

    for one hour.
11. Save

    SAMLConfig.xml.

12. Go to

    \MicroStrategyLibrary\WEB-INF\classes\auth.

13. Create a new folder called

    custom.

14. Copy the

    SAMLConfig.xml

    file from step 11 to the

    custom

    folder created in step 13.
15. Restart the application server.