Authentication Hub error - There are no obligations to request, returning AUTH_DENIED

Products

• VIP Authentication Hub

Issue/Introduction

So we are getting a weird error when attempting to login via SiteMinder. Sometimes it works in Chrome, fails in Edge, or works in Edge and fails in Chrome

What does "There are no obligations to request, returning AUTH_DENIED" mean?

12/2/22 1:59:48.320 PM	{ [-]    api: /auth/v1/authenticate    appId: 7cb1c508-84c0-4d33-9198-0800baccabe5    appName: Siteminder QA YLD and PL1    auth-mgr-auth-ext-aal:    auth-mgr-auth-ext-acr:    auth-mgr-auth-ext-amr:    auth-mgr-auth-ext-appName: Siteminder QA YLD and PL1    auth-mgr-auth-ext-appURL:    auth-mgr-auth-ext-deviceType: web    auth-mgr-auth-ext-policyName: [SiteMinder ]    auth-mgr-auth-ext-sid:    auth-mgr-auth-ext-userAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.62    clientId: 289ddd6a-2ade-42cf-8b27-81f9ea0b57b1    clientIp: 10.246.21.118    clientTid: ac0f0bc1-f4ed-46b5-b118-ad7463f3438d    clientTxnId: 6c4f7361-968c-44ce-82ff-c4f315b190c5    effectiveClientId: 289ddd6a-2ade-42cf-8b27-81f9ea0b57b1    effectiveClientTid: ac0f0bc1-f4ed-46b5-b118-ad7463f3438d    eventId: auth-mgr.auth.failure    flowStateId: null    geo.city_name: UNKNOWN    geo.country_name: UNKNOWN    geo.location: { [+]    }    geo.state_name: UNKNOWN    guid: 133b424d-a1be-41fa-9ad4-91b537994856    httpMethod: POST    msg: AUTH DENIED    relVersion: 1.0    requestedUserIpToBeAuditedByApp:    responseCode: 200 OK    service: authmgr    sid:     sub: 7fd0cf71-3feb-40e9-81a8-93b443b712c3    subType: USER    tid: ac0f0bc1-f4ed-46b5-b118-ad7463f3438d    timestamp: 2022-12-02T18:59:48.319682Z    tname: default    txnId: 3b0b7e5a-577b-4430-8215-c6dfcc7af27d    type: audit    userAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.62    userDN: uid=XBBLPLM,cn=People,ou=Internal,o=mfc    userGuid:     userIdpGuid: 911914d4-4509-43d0-bcb1-248a8cd5b0ef    userIp: 10.246.21.118    userLoginId: XBB1LPLM    userLoginIdAttributeMappingName: user_loginid    userRiskLevel:    userRiskScore: 0    userUniversalId: XBB1LPLM }
	12/2/22 1:59:48.299 PM	{ [-]    api: /auth/v1/authenticate    appId: 7cb1c508-84c0-4d33-9198-0800baccabe5    appName: Siteminder QA YLD and PL1    clientId: 0b548cfe-ea64-461e-98ce-cd436669b29d    clientIp: 10.246.21.118    clientTid: ac0f0bc1-f4ed-46b5-b118-ad7463f3438d    clientTxnId: 6c4f7361-968c-44ce-82ff-c4f315b190c5    flowStateId: null    httpMethod: POST    level: info    msg: There are no obligations to request, returning AUTH_DENIED    relVersion: 1.0    requestedUserIpToBeAuditedByApp: null    service: authmgr    sid:     sub: null    subType: USER    thread: https-jsse-nio-8086-exec-9    tid: ac0f0bc1-f4ed-46b5-b118-ad7463f3438d    timestamp: 2022-12-02T18:59:48.299798Z    tname: default    txnId: 3b0b7e5a-577b-4430-8215-c6dfcc7af27d    type: log    userAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.62    userGuid:     userIp: 10.246.21.118    userLoginId: XBB1LPLM    userRiskLevel:     userRiskScore: 0    userUniversalId:  }   Show as raw text

Environment

Release : Oct.02 Release

Resolution

msg: Inline enrollment is disabled, checking for available obligations
msg: There are no obligations to request, returning AUTH_DENIED

is coming in logs because that the auth policy is requiring a factor, but the user is not enrolled with that factor, or the request does not match with any policies. We will require the export of the policies to analyze which factor is required by the policy.