Result of authorizeEx call is: 2


Article ID: 141265


Updated On:


CA Single Sign On Secure Proxy Server (SiteMinder) AXIOMATICS POLICY SERVER CA Single Sign On Agents (SiteMinder) CA Single Sign On Federation (SiteMinder) CA Single Sign On SOA Security Manager (SiteMinder) SITEMINDER



We're running Federation Service to protect a specific application as
IdP, when the Federation Service receives the SAMLRequest, then the
browser get return code 403 :

  Denying request due to authorizeEx call failure,

and the Federation Service reports error :

  of authorizeEx call is: 2.]

  the assertion/artifact response based on profile selected. [CHECKPOINT

  with ID: 7d55ds64-f4ewe2bfe-2d257dsadd-e4ww07a8-5e82d906-ce2
  failed. Reason: FAILED_AUTHEX]

  request due to authorizeEx call failure.]

  403 error]

The user is authenticated by the User Directory where the email fields
has no value, then the user cannot get access to the application. You
need the product to get the email user attribute from the other User

How can we fix that ?



Release : 12.52




In Federation Journey, you cannot get user attributes from more than 1
User Directory if you run Policy Server and AdminUI version prior to
12.8SP3 as related in this thread :

  Re: SiteMinder Federation - how to retrieve attributes from 2 user
  directories for a single assertion

    Hello, In Federation you can not use Directory Mapping as you could
    use for A standard SiteMinder integration (Authenticate in directory A
    and authorize in directory B). You can not retrieve attributes from
    multiple user directories. You can retrieve attributes from the
    directory where you have been authenticated. As krish04 told you, you
    can maybe archive that by using a custom assertion plug-in
    generator. Hope it helps, Julien.

If you upgrade the environment to 12.8SP3, then you'll benifit this
feature which will allow you to get the user authenticated in one User
Directory and the email value picked from a second User Directory :

  Identity Mapping for Federation Partnerships

    You can now configure the Identity Mapping feature in SAML 2.0
    IdP SP partnerships. This feature allows you to perform user
    authentication and authorization using different user directories at
    IdP. Attributes are returned from the user directory that authorizes a
    user.  In Administrative UI, the Configure Partnership step of
    partnership creation now includes new fields to enable the feature.

Identity Mapping in SAML 2.0 Federation

  Identity Mapping in a SAML 2.0 IdP -> SP federation partnership lets
  you authenticate users with one user directory and authorize them with
  another user directory at IdP. The assertion attributes are returned
  from the user directory that authorizes the user.

Out of the Box, Policy Server has no functionality to validate if the
value of the email attribute is empty or not, and if empty to search
the next directory.

The expression are used as filter to check and process different
attributes for the "same" User Director as related in this community
thread :

  Some extra help with SiteMinder expression attribute

The most probable way to search the user in the first directory, and
if the email value is null to search for it in the second directory
will be to create a Custom Assertion Generator Plugin, which will
avoid that error :

  the assertion/artifact response based on profile

  [Transaction with ID: 7dba0f64-f4722bfe-2d257c8f-e4df07a8-5e82d906-ce2 
   failed. Reason: FAILED_AUTHEX]

  [Denying request due to authorizeEx call failure.]