Bug: IWA/WinSSO Realms Using Adaptive Authentication Group Redirection Cause an Infinite Redirection Loop

Version Affected: 9.2.0-7 through 9.2.0-18
Bug Number: EE-953, EE-967
Bug Status: Closed - Fixed
Fixed in Version(s): 9.3

 

Overview

An IWA (Integrated Windows Authentication) or WinSSO realm using Adaptive Authentication to redirect based on user or group membership enters an infinite redirection loop between SecureAuth.aspx and WinSSO.aspx, instead of redirecting successfully.

 

Cause

This is a product defect. It occurs when all of the following are true:

• The realm is an IWA/WinSSO realm.
• Adaptive Authentication is enabled with a user or group restriction.
• The failure action is set to redirect.
• The user logging in belongs to a "Deny" group.

Resolution / Workaround

Upgrade to version 9.3 or later to resolve this issue. On earlier versions, use the following workaround.

In realms not using OpenID, replace:

D:\SecureAuth\SecureAuth<realm>\bin\MFA.WebControls.dll

with a copy of the stock version:

D:\SecureAuth\Template\bin\MFA.WebControls.dll

In realms using OpenID, contact SecureAuth Support instead.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.