Troubleshooting: SecureAuth CIAM Sign-In or Token Requests Fail Because an Extension Script Times Out

Version Affected: All
 
 

Overview

Sign-in or token requests in SecureAuth CIAM fail because an extension script times out. The failures often come in bursts, and the client receives a generic error rather than one that names the script. Typical signs are:

• Users get a 401 or Server Error page when they sign in, often through an external identity provider.
• The workspace's audit logs show access_token or authorization_code events with the action denied and "error_description": "The error is unrecognizable", for authorization code, refresh token or token exchange requests.
• A script_executed event with the same authorization correlation ID shows "error": "timeout".

Cause

Extension scripts, such as post-authentication, pre-token minting and identity provider discovery scripts, run in SecureAuth CIAM's script runtime with a time limit of 3 seconds by default. A script that has not returned when the limit is reached is stopped, and the request it belongs to fails: a sign-in returns an error page, and a token request is denied with The error is unrecognizable.

The script is usually waiting on an external API, such as a user or profile lookup, that is slow or under load. The failures then come in bursts that match that API's slow periods. Each run is recorded as a script_executed event in the workspace's audit logs, for example:

"script_executed": {
  "script_name": "<script-name>",
  "execution_point": "post_authn_ctx",
  "duration": "0s",
  "stdout": "",
  "stderr": "",
  "caught_err": "timeout",
  "error": "timeout"
}

Because the runtime stops the script, rather than the script failing on its own, nothing is written to stderr or stdout. The timeout appears only in the error and caught_err fields, so monitoring that watches stderr alone misses these failures. Messages the script logged before it was stopped are not recorded either, so they cannot show which call was slow.

Resolution:

To resolve this:

1. In the workspace's Audit Logs, find a failed request by its authorization correlation ID and open its script_executed event. Confirm that error is timeout, and note the script_name and execution_point.
2. List the external calls that script makes, and check their response times at the times of the failures. A call that takes close to 3 seconds, or several calls that add up to it, is the cause.
3. Make the script finish well within the limit. Speed up or scale the external API, request only the data the script needs, and cache values that do not change on every request. For example, keep an API access token in a variable outside the exported function, so that each run reuses it instead of requesting a new one.
4. Give every outbound call in the script its own timeout, shorter than the script's limit, and handle the failure inside the script: either continue without the extra data, or return a custom error. In a pre-token minting script, a custom error gives the client a clear message and status code instead of The error is unrecognizable. Use this format, where the code must be 400, 401, 403 or 429:

   module.exports = async function (context) {
     return { error: { message: "<message for the client>", code: 403 } };
   };

5. Update your monitoring to alert on payload.script_executed.error, not only on payload.script_executed.stderr.
6. If the script cannot be made faster straight away, ask SecureAuth Support to raise the script time limit for your tenant. It can be raised to at most 4 seconds, because the whole request must finish within 10 seconds.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.