Troubleshooting: Transformation Engine Stops Working After Enabling Transparent SSO or SecurePortal

Version Affected: All

 

Overview

A realm's Transformation Engine (TE) rule that works correctly on its own can stop working, or start working intermittently, once Transparent SSO or SecurePortal is enabled on that realm.

Cause

How the user is authenticated when signing in through Transparent SSO or SecurePortal can prevent the Transformation Engine from being able to set its result on the Authenticated User attribute specifically. TE rules that write to any other profile attribute are not affected.

Resolution:

1. On the realm's Data tab, identify a profile attribute that is not currently in use and is not marked as writable.
2. Move the Transformation Engine setting from the Authenticated User attribute to that unused attribute. For example, if the XSLT currently has:
   

   <UserID>
     <xsl:value-of select="user:UpperCase(user/UserID)"/>
   </UserID>

   change it to use the unused attribute instead — for example, Phone4:
   

   <Phone4>
     <xsl:value-of select="user:UpperCase(user/UserID)"/>
   </Phone4>

   The value of select stays the same; only the destination attribute changes, from UserID to Phone4 in this example.
3. Update every UserID Mapping or SAML claim that currently reads from Authenticated User ID to read from the new profile field instead (Phone4 in this example).
4. Save the changes.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.