Bug: Transparent SSO Fails for Users With a Comma in Their Password

Version Affected: 22.12 (also seen on other pre-fix versions)
Bug Number: EE-3292
Bug Status: Closed - Fixed
Fixed in Version(s): 22.12 HF8+, 23.07 HF2+

 

Overview

Transparent SSO (TSSO) can fail for some users when the realm uses a Custom Token for Password that is not encrypted. The end user sees a generic System Error page ("We are unable to continue at this time. Please close your browser and try again. Error has been logged."), and the realm's Error log shows a SAML20SPInitPost error with a Thread was being aborted stack trace.

Cause

When Transparent SSO is used with a Custom Token for Password that is not encrypted, affected users' passwords contain a comma. The comma breaks parsing of the custom token, causing the error above.

Resolution / Workaround

Upgrade to 22.12 HF8 or later, or 23.07 HF2 or later, to resolve this issue (defect EE-3292).

If upgrading to one of those hotfixes is not an option right now, there are two workarounds:

1. If possible, change the realm configuration under the Workflow tab to encrypt the password -- some applications do not accept a base64-encoded password, so confirm the target application supports it first. Set the Custom Token Fields value as shown below:

2. Alternatively, have the affected user change their password to one that does not contain a comma.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.