Error: SAML SSO login loops back to login page after v24 upgrade

Products

CA Automic Workload Automation - Automation Engine

Issue/Introduction

After upgrading to version 24․4․2 hf3, users cannot log in to the Automic Web Interface (AWI) using SAML SSO because the browser loops back to the credential page without displaying an error message․‌

SYMPTOMS:

Local authentication (non-SSO) works normally․
SAML redirection occurs, but the session lands back on the AWI login page․

Environment

Automic Automation Engine Version: 24․4․2 hf3

Component: Automic Web Interface (AWI)

Authentication: SAML SSO

Database: Oracle

Cause

The v24 upgrade introduces stricter requirements for SAML metadata matching, specifically regarding trailing slashes in EntityIDs and the presence of specific library files for token processing․

When the AWI is hosted on a Java web server like Apache Tomcat, /awi represents a context root. If the trailing slash is missing (e.g., .../awi), Tomcat’s default behavior is to issue an HTTP 302 Redirect to the same URL with the slash (.../awi/) to ensure relative links resolve correctly.

This redirect is fatal to SAML because:

POST to GET Conversion: When the IdP (Okta, Azure, etc.) sends the SAML Token via an HTTP POST to the URL without the slash, Tomcat responds with a 302.
Payload Loss: Browsers following a 302 redirect typically change the method from POST to GET and discard the POST body (the XML SAML Assertion).
Authentication Failure: AWI receives a GET request with no SAML data, causing the authentication to derail and loop the user back to the login page.

Resolution

First, add any missing libraries: Ensure all of the required JAR files (as described here: Setting up Single Sign-On - SAML) are present in the Automation Engine/bin/lib folder.

Next, configure trailing slashes in UC_SAML_SETTINGS -> key: *SP. This key has several attributes where the forward slash must be specified (as documented here: UC_SAML_SETTINGS - Single Sign-On), including:

entityID
Location attribute for the HTTP-POST binding
Location attribute for the HTTP-Artifact binding

Example: https://[AWI_URL]/awi/

Important:

Make sure your idP is configured correctly - using the same trailing slash in it's appropriate attributes (ex: Single Sign On URL, Audience URL, etc..).

Additional Information

When everything else was setup/configured correctly, except the idP using the trailing slashes, the following items were observed:

AE PWP Logs:

U00003227 Redirect to SAML-IdP required

AE JWP Logs:

Metadata Resolver SamlIdPMetadataResolver <idPiD>: New metadata successfully loaded for '<SAML/SSO/idP URL>'

AE PWP Logs:

U00011800 Disconnect User: Cannot find user '*CP001#00000004' in the table AKT-USER.

Meanwhile, while the AE logs above showed those messages, the Chrome Inspection (right click on page -> Inspect) -> Network page/tool showed:

A POST request method being sent to the "awi" page (with a payload) getting a 302.
The next call was a GET request method being sent to the "awi/" page (with no payload) because the SAMLResponse is dropped.