CB Response: SSO login redirects back to the Response login page after authentication rather than the Response HUD page.

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

A session cookie issue is logged in /var/log/cb/coreservices/debug.log in each customer case we have looked at:

2019-10-02 10:55:17 [26619] <err> cb.flask.blueprint_helpers - Unhandled exception from API request: '_xsrf_token'
Traceback (most recent call last):
File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/flask/app.py", line 1813, in full_dispatch_request
rv = self.dispatch_request()
File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/flask/app.py", line 1799, in dispatch_request
return self.view_functions[rule.endpoint](**req.view_args)
File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/cb/auth/authn_service.py", line 341, in wrapped_f
File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/werkzeug/local.py", line 378, in <lambda>
_getitem_ = lambda x, i: x._get_current_object()[i]
File "/usr/share/cb/virtualenv/lib/python2.7/site-packages/flask/sessions.py", line 83, in _getitem_
return super(SecureCookieSession, self)._getitem_(key)
KeyError: '_xsrf_token'
2019-10-02 10:55:19 [26619] <warning> cb.auth.authn_service - User Authentication Activity: User Id=31, Status=200, Ip Address=10.10.10.10, Timestamp=2019-10-02 14:55:19.231549+00:00

Environment

• CB Response Server: 6.5.x
• CB Response Sensor: All Versions

Cause

This is issue CB-29409.

Resolution

CB-29409 is fixed in the 7.0.1 and later release.

Additional Information

This can be worked around by clicking on the CB Response Login button after the first SSO login, without needing to enter a username and password, and you are properly redirected to the HUD. You can also open a new browser window after the initial SSO login and it is already authenticated.