Troubleshooting: "Validation of Viewstate MAC Failed" Error

Version Affected: All
 
 

Overview

Users authenticating against a SecureAuth IdP High Availability (HA) pair can intermittently see a "Validation of viewstate MAC failed" error:

There are multiple potential causes, distinguished by how traffic is being distributed across the HA pair:

• See Cause 1 - The HA pair uses DNS round robin instead of a load balancer
• See Cause 2 - The HA pair uses a load balancer, but its session persistence is not sticky
• See Cause 3 - The HA pair's <machineKey> configuration does not match between servers

These causes are not related, so a fix for one cause will not resolve the other.

 

In this article

• Cause 1: DNS Round Robin Used Instead of a Load Balancer
• Cause 2: Load Balancer Session Persistence Not Set to Sticky
• Cause 3: HA Pair's <machineKey> Configuration Does Not Match

Cause 1: DNS Round Robin Used Instead of a Load Balancer

DNS round robin is not supported for distributing traffic across an IdP HA pair. During authentication, a user can land on either server in the pair from one request to the next. Since DNS round robin provides no session affinity, the server handling a given request may not know what state the user is in partway through the authentication process, causing the viewstate MAC validation error.

Resolution 1:

Replace DNS round robin with a load balancer in front of the HA pair, and configure the load balancer with session persistence (see Cause 2's resolution for the specific setting to use).

Cause 2: Load Balancer Session Persistence Not Set to Sticky

The HA pair is already behind a load balancer, but the load balancer's session persistence is set to transient rather than sticky. Without sticky session persistence, a user's requests can be routed to a different server in the HA pair mid-authentication, which produces the same viewstate MAC validation error.

Resolution 2:

On the load balancer, change the session persistence setting from transient to sticky (also called IP Persistent on some load balancers), so a user's requests stay on the same server for the duration of their session.

Cause 3: HA Pair's <machineKey> Configuration Does Not Match

The HA pair's <machineKey> configuration is different between the two servers -- specifically, the machine key shown on each server's Token Settings page does not match. This produces the same viewstate MAC validation error even when DNS round robin and load balancer session persistence are both configured correctly, since the two servers can no longer validate each other's viewstate.

Resolution 3:

Copy the machine key from the server that is working correctly into the Token Settings page of the server showing the error, so both servers in the HA pair use the same key.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.