Test user is getting a "Permission denied" error trying to access ZTNA Web application

Products

• Symantec ZTNA

Issue/Introduction

ZTNA POC enabled.

SAML authentication enabled to a home grown SAML IDP server using generic SAML setup (without SCIM).

Users are provisioned in the local identity provider based on SAML attributes from the assertion.

A number of users cloud access the ZTNA portal, after authenticating and access applications via the dashboard or directly (many Web applications were using external DNS names instead of the luminatesec.com path).

One user tried to access an application directly, and got a customised message referencing that 'you do not have access to this application'). The error description reported in the browser URL referenced an errro_description field of 'Authentication failed'.

HAR file shows that the error occurred immediately after the SAML assertion was POSTed by the user agent. 

ZTNA forensic or audit logs showed no request from the user or the user IP address for the failing application.

 

 

Environment

ZTNA. 

SAML Authentication.

Cause

SAML assertion too large to consume.

Resolution

Modify the IDP server assertion details to include all needed groups rather than all groups.

In the above case, the HAR file SAMLResponse (which is the assertion) was 16kBs in size, and included over 1000 groups. When the ZTNA SAML service provider consumed the assertion, it errored out as it exceeded a threshold.

Working with the SAML Identity server folks, a regex was defined to send a subset of groups needed for ZTNA, which addressed the issue.