Timeouts or ERR_EMPTY_Response When Modifying Administrative Tasks in Identity Manager

Products

• CA Identity Suite
• CA Identity Manager

Issue/Introduction

After switching to a SAML 2.0 authentication (e.g., using Mosaic or a similar Identity Provider), administrators may encounter issue within the Identity Manager (IDM) Console. The primary symptoms include:

• Timeouts occurring when submitting modifications or opening different tabs within the Modify Administrative Task action.
• The browser page remains on a loading screen for several minutes before returning an ERR_EMPTY_Response or timing out.
  
  

Environment

CA Identity Manager / CA Identity Suite 14.x

Cause

The timeout and ERR_EMPTY_Response errors are typically environmental and not inherent to the IDM application logic. In documented cases, these behaviors were traced to Web Application Firewall (WAF) configurations that were improperly intercepting, delaying, or dropping long-running requests or specific headers during administrative task submissions.

Resolution

To resolve the administrative task timeouts:

1. Review WAF Configuration: Inspect the WAF or any network security appliances (Load Balancers/Proxies) in the communication path. Ensure they are not stripping headers or terminating connections prematurely for the IDM endpoints.
2. Verify Network Path: Check for any security rules that might be blocking or throttling large POST requests associated with administrative task modifications.
3. Validate Direct Connectivity: Test the Identity Manager Environment (IME) URL directly from within the network to bypass potential WAF/Proxy interference and verify if the issue persists.