[SiteMinder][AccessGateway][FWS] 500 Internal server error while initiating federation - More than the maximum allowed number of cookies, [200], were detected.
search cancel

[SiteMinder][AccessGateway][FWS] 500 Internal server error while initiating federation - More than the maximum allowed number of cookies, [200], were detected.

book

Article ID: 218111

calendar_today

Updated On:

Products

SITEMINDER CA Single Sign On Secure Proxy Server (SiteMinder) CA Single Sign On Federation (SiteMinder) CA Single Sign On Agents (SiteMinder)

Issue/Introduction

[Use Case]

Access Gateway is used for SAML Federation.
User logon at the IDP first then initiates SAML Federation and gets HTTP 500.
This happens to only certain users (who belongs to many groups).

 

In the Access Gateway's httpclient.log, following error was observed.

Jun 10, 2021 01:23:45 PM org.apache.coyote.ajp.AjpProcessor process
SEVERE: Error processing request
java.lang.IllegalArgumentException: More than the maximum allowed number of cookies, [200], were detected.
 at org.apache.tomcat.util.http.Cookies.addCookie(Cookies.java:132)
 at org.apache.tomcat.util.http.Cookies.processCookieHeader(Cookies.java:507)
 at org.apache.tomcat.util.http.Cookies.processCookies(Cookies.java:198)
 at org.apache.tomcat.util.http.Cookies.getCookieCount(Cookies.java:119)
 at org.apache.catalina.connector.CoyoteAdapter.parseSessionCookiesId(CoyoteAdapter.java:1098)
 at org.apache.catalina.connector.CoyoteAdapter.postParseRequest(CoyoteAdapter.java:803)
 at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:440)
 at org.apache.coyote.ajp.AjpProcessor.process(AjpProcessor.java:190)
 at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637)
 at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316)
 at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
 at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
 at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
 at java.lang.Thread.run(Thread.java:748)

 

But in fiddler log, there are only few cookies.

Environment

Release : 12.8

Component : SITEMINDER -POLICY SERVER

Cause

There was an OnAuthAccept response setting cookie(WebAgent-HTTP-Cookie-Variable) with user's group information using "memberOf" attribute.

When initiating SAML Federation, this cookie gets submitted and Tomcat reports exception and fail to handle the request as there were more than 200 cookies in the request.
By default, tomcat handles request with upto maximum of 200 cookies.

 

Following configuration changed was applied to httpd-ssl.conf in Access Gateway to log the incoming cookies in the request.

From:

#CustomLog "|bin/rotatelogs.exe -l D:/SPS_logs/ssl_request.log 10M" \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

To:

CustomLog "|bin/rotatelogs.exe -l D:/SPS_logs/ssl_request.log 10M" \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b (Cookie: %{Cookie}i)"

 

After restarting Access Gateway and reproducing the issue, following was captured in the ssl_request.log

[22/Jun/2021:10:25:54 +1000] 192.168.0.7 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 "GET /default.ico HTTP/1.1" 16694 (Cookie: ASPSESSIONIDSADTSTDS=####; ROUTEID=.1; SMSESSION=+9w4fNpVERJigsjKmrqJkenjV89wJH4wuCgYVs................................................................6FM5qlkcXSsgv2pAOWEaZOqh+T; GroupCookie=CN=G20,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G19,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G18,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G17,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G16,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G15,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G14,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G13,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G12,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G11,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G10,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G09,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G08,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G07,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G06,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G05,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G04,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G03,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G02,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G01,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=TEST-Admin-Group,OU=TEST-Admins,DC=Example,DC=Com^CN=TEST-Admins,CN=Managed Service Accounts,DC=Example,DC=Com)

There were 246 commas in the GroupCookie value.
When there are special characters in the cookie name or value, they must be escaped or wrapped with double quotes.
But this cookie that was set by a web server that did not have any escaping or wrapping in place.
As a result, tomcat saw the commas as cookie separators and there were more than 200 of them.

Resolution

1. Check the web server that is setting the cookie and see if it can wrap the value.
2. Use Access Gateway to set the response cookie (Access Gateway will wrap it when there are special characters, this would also mean the login will need to be processed by the Access Gateway)
3. Set HTTP header response(WebAgent-HTTP-Header-Variable) instead of cookie response(WebAgent-HTTP-Cookie-Variable).

 

Additional Information

Sample of properly wrapped cookie generated by Access Gateway.
Note the \" at the beginning and end of GroupCookie value.

[22/Jun/2021:10:25:54 +1000] 192.168.0.7 TLSv1.2 ECDHE-RSA-AES128-GCM-SHA256 "GET /default.ico HTTP/1.1" 16694 (Cookie: ASPSESSIONIDSADTSTDS=####; ROUTEID=.1; SMSESSION=+9w4fNpVERJigsjKmrqJkenjV89wJH4wuCgYVs.................................................................AQEMebrgIbDMd9NnbmC2ZcGZwqjz6FM5qlkcXSsgv2pAOWEaZOqh+T; GroupCookie=\"CN=G20,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G19,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G18,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G17,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G16,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G15,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G14,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G13,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G12,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G11,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G10,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G09,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G08,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G07,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G06,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G05,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G04,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G03,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G02,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=G01,OU=OU10,OU=OU9,OU=OU8,OU=OU7,OU=OU6,OU=OU5,OU=OU4,OU=OU3,OU=OU2,OU=OU1,DC=Example,DC=Com^CN=TEST-Admin-Group,OU=TEST-Admins,DC=Example,DC=Com^CN=TEST-Admins,CN=Managed Service Accounts,DC=Example,DC=Com\")
Powered by Wolken Software