7016168: Extra SSPR login prompt or 5071 error with OSP integration

Novell Novell

This document (7016168) is provided subject to the disclaimer at the end of this document.

Environment

SSPR 3.2

SSPR 3.3

Integrated with OSP (OAuth)

IDM 4.5

IDM 4.5 SP1

eDirectory environment

NMAS universal password policy defined

Situation

SSPR Error 5071: An error using the OAuth authentication protocol has occurred. Please try again later. 5071 ERROR_OAUTH_ERROR

Alternatively, the user may be prompted for password to login to SSPR page after successfully logging into OSP.

SSPR does not trust the OAuth login and presents prompt for second password.
SSPR cannot read the NMAS password.

Resolution

One or all of the following actions may be needed. Try them in the order presented.

1. Apply patches: SSPR 3.3.1 or newer, IDM 4.5.2 or newer and OSP 6.0 Hot Fix 3 or newer

2. Give the SSPR Proxy User rights to read the universal password (see below).

3. Delete SSPR cache files (go to apache-tomcat-<version>work and delete the catalina folder)

4. Make sure the secrets shared between SSPR and OSP are correct by resetting the OAuth client secret in configupdate.sh, and the OAuth Shared Secret in SSPR Configuration Editor, Settings, Single Sign On, OAuth as shown:


Steps for granting rights to read the password to the SSPR Proxy User:

1. Launch iManager and open “Password Policy” under the “Passwords” plugin

2. Select the desired policy

3. Select Universal Password

4. Open Configuration options

5. Click “Allow the following to retrieve passwords”

6. Click “Insert”

7. Browse to or type in the SSPR Prox user.

Additional Information

In one case the following was seen in SSPR error log:

auth.LDAPAuthenticationRequest unable to retrieve user password from ldap: error reading nmas password: error -1697

http.PwmRequest 5071 ERROR_OAUTH_ERROR (5015 ERROR_UNKNOWN (no available unknown-pw authentication method))

Disclaimer

This Support Knowledgebase provides a valuable tool for NetIQ/Novell/SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented “AS IS” WITHOUT WARRANTY OF ANY KIND.

Related:

Leave a Reply