Auto login timeout expired, possibly due to wrong credentials. Please contact your administrator
Article ID: 124059
Updated On:
Products
CA Privileged Access Manager - Cloakware Password Authority (PA)
CA Privileged Access Manager (PAM)
Issue/Introduction
"HTML Web SSO" is configured for SPLUNK Web Portal.
From one PAM Client, the Auto-Login works fine but on another PAM Client it fails with an error message.
"Auto login timeout expired, possibly due to wrong credentials. Please contact your administrator."
PAM Client #1 has "en-US" as the OS Language setting.
PAM Client #2 has "en-GB" as the OS Language setting.
PAM Client #1 is able to successfully auto-login to Splunk Web Portal.
PAM Client #2 fails to login and gets following error popup message.
"Auto login timeout expired, possibly due to wrong credentials. Please contact your administrator."
From one PAM Client, the Auto-Login works fine but on another PAM Client it fails with an error message.
"Auto login timeout expired, possibly due to wrong credentials. Please contact your administrator."
PAM Client #1 has "en-US" as the OS Language setting.
PAM Client #2 has "en-GB" as the OS Language setting.
PAM Client #1 is able to successfully auto-login to Splunk Web Portal.
PAM Client #2 fails to login and gets following error popup message.
"Auto login timeout expired, possibly due to wrong credentials. Please contact your administrator."
Environment
Release:
Component: CAPAMX
Component: CAPAMX
Resolution
The reason why the auto-login fails is because Splunk would detect the Client's Language Setting.
When the Auto-Login Template was saved, it was going against "https://<FQHN_IP>/en-US/account/login"
As a result, PAM would be looking for this URL and will POST the user credentials when the URL matches.
But because PAM Client #2 has "en-GB" Language setting, Splunk would redirect the client to "https://<FQHN_IP>/en-GB/account/login" which does not match the URL stored in the Auto-Login Template.
As the matching login page never loads within the auto-login timeout, you will be getting the "Login failed" message due to "Auto login timeout expired".
PAM never POSTed any user credentials in this case.
To ensure the Auto-Login works, you will need to update the TCP Service in PAM as below.
Launch URL: https://<First IP>:<First Port>/en-US/
This will force the Splunk to display the login page with "en-US" setting even when the Client OS Language is set to "en-GB".
(Setting the "Keyboard Layout" to "en-US" or "en-GB" from user profile setting does not resolve this.)
Another option would be to ensure the Client OS Language setting matches the Auto-Login Template when it was being saved.
If you create new Auto-Login Template from client with "en-GB" setting then the "en-US" users would fail to login.
This is not a PAM product defect, you just need to understand your Web Portal application's behavior.
When the Auto-Login Template was saved, it was going against "https://<FQHN_IP>/en-US/account/login"
As a result, PAM would be looking for this URL and will POST the user credentials when the URL matches.
But because PAM Client #2 has "en-GB" Language setting, Splunk would redirect the client to "https://<FQHN_IP>/en-GB/account/login" which does not match the URL stored in the Auto-Login Template.
As the matching login page never loads within the auto-login timeout, you will be getting the "Login failed" message due to "Auto login timeout expired".
PAM never POSTed any user credentials in this case.
To ensure the Auto-Login works, you will need to update the TCP Service in PAM as below.
Launch URL: https://<First IP>:<First Port>/en-US/
This will force the Splunk to display the login page with "en-US" setting even when the Client OS Language is set to "en-GB".
(Setting the "Keyboard Layout" to "en-US" or "en-GB" from user profile setting does not resolve this.)
Another option would be to ensure the Client OS Language setting matches the Auto-Login Template when it was being saved.
If you create new Auto-Login Template from client with "en-GB" setting then the "en-US" users would fail to login.
This is not a PAM product defect, you just need to understand your Web Portal application's behavior.
Feedback
Yes
No
Powered by
