Troubleshooting: 504 Gateway Timeout for Certain Users

Version Affected: 19.07.01 and later
 
 

Overview

In environments using the SecureAuth Connector, some users receive a 504 Gateway Timeout error partway through a login workflow where Username (and Password) is entered on the first screen. Instead of being shown their MFA options on the following screen, they see the timeout error instead.

 

Cause

The Debug Log shows an entry referencing:

Message="MFA.WebControls.MFALoginControl.Dispose: switch s.ID = PROFILEDATAERROR"

This indicates the user's profile data failed to load in time. Two things commonly cause this:

• A recent change to one of the user's datastore attributes has produced an invalid or unexpectedly large value.
• The user belongs to an unusually large number of groups, which slows the profile lookup down enough to trigger the timeout on its own, even with otherwise valid attribute values.

Resolution

1. Check the affected user's datastore attributes for anything that changed recently — an invalid or unusually large attribute value can produce this same profile data error on its own, independent of group membership.
2. If the attributes look correct, check how many groups the user belongs to.
3. Reduce the number of groups the user belongs to where possible. An exorbitant number of group memberships can lead directly to the timeout, even without any other underlying issue.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.