Error: Temporary login issue during OIDC authentication - Messaging Gateway

Products

• Messaging Gateway

Issue/Introduction

After successful authentication with the OIDC provider, the user is redirected back to Messaging Gateway (SMG) but sees the following error:

`Temporary login issue encountered. Please try again later or contact your system administrator for assistance.`

Environment

Messaging Gateway 10.9

Cause

The SMG OIDC implementation has a hard-coded limit of 51,200 bytes (50 KB) for the JWKS response retrieved from the identity provider. If the provider's JWKS exceeds this size, the validation of the ID token fails.

 

BrightmailLog logs shows:

ERROR - Exception thrown in OidcSecurityFilter::doFilterInternal: com.symantec.smg.controlcenter.accesscontrol.oidcintegration.OpenIDConnectException: Exception occured while validating the ID Token. ; nested exception is: com.nimbusds.jose.RemoteKeySourceException: Couldn't retrieve remote JWK set: Exceeded configured input limit of 51200 bytes

 

 

Resolution

Review and reduce the size of the JWKS response on the OIDC identity provider side. The 50 KB limit in SMG is not configurable at this time.

Follow these steps to ensure the JWKS response remains under the limit:

1. Remove any unused or expired signing keys from the provider.
2. Limit the number of active keys (recommend 1–3 keys).
3. Publish only necessary signing keys to the JWKS endpoint.