App Metrics redirect loop when authenticating with SSO/SAML

Products

• Operations Manager

Issue/Introduction

When using SSO/SAML to authenticate into the App Metrics application, you are redirected back to a login page where if you try to authenticate again, the same thing will happen.

To replicate this issue, follow the steps below:

1. You navigate to https://appmetrics.<system-domain>.
2. Navigated to the login screen.
3. Click on the SSO link to authenticate.
4. You are directed to the SSO login page where the login credentials are entered.
5. After submitting credentials, you are redirected back to the login screen again rather then the App Metrics dashboard.

Resolution

The issue stems from the fact that the UAA URL is defined as uaa.<system-domain> in the App Metrics application, however, in previous versions the UAA URL was defined as login.<system-domain>.

Normally your SSO/SAML service is set up to use login.<system-domain> as the authentication point, however, having UAA URL point to uaa.<system-domain> will break the integration.

Workaround

There are two possible solutions:

1. Update the SSO/SAML integration to accept both domains:

• uaa.<system-domain>
• login.<system-domain>

If you are unsure how update SAML integration, please refer to the Configure SAML Integration in AD FS documentation or talk with your SAML administrator.

2. As a temporary workaround, you can manually update the UAA_URL environment variable for App Metrics to point back to login.<system-domain>.

$ > cf target -o system -s space app-metrics-v2
$ > cf set-env appmetrics UAA_URL login.<system-domain>
$ > cf restage appmetrics

Note: Please note that this is a temporary workaround and these changes will be reverted when the errand to deploy Apps Metrics is run.