IDSP AuthComplete Failure on Second-Factor Authentication Due to Exceeded Max User Session Limit
Article ID: 449135
Updated On:
Products
Issue/Introduction
When running IDSP, clients on both mobile and web sessions cannot complete authentication after the second factor, during the AuthComplete flow. The following log entries are observed (duplicated in the logs at the time of failure):
AuthComplete: Auth complete request for UserId: <userid>, UserLoginId: <userloginid>, identitySourceId: <identitysourceid>, identitySourceName: <identitysourcename>, identitySourceType: scim, isAuthAllowed: true, errorMsg: 'Authentication failed', ServerName: server.example.com, RemoteHost: 127.0.0.1, flowType: OIDC
Environment
- IDSP 4.0.3
Cause
Tracing the associated flowStateId, the following messages appear:
Number of allowed sessions has been exceeded10 are same or more than allowed max user sessions: 10
This indicates the user has reached the maximum number of concurrent sessions permitted (10), which causes subsequent authentication attempts to fail at the AuthComplete stage even though isAuthAllowed is reported as true.
Related known issue: Broadcom's Release Notes for IDSP 4.0.1 document bug DE661313, where the BYOI (Bring Your Own Identity) flow was not enforcing maximum session limits per user, allowing users to exceed configured session thresholds (1). Confirm whether the environment is fully patched, as unpatched session-limit enforcement bugs can produce similar symptoms.
Resolution
- Reduce the ssoExpirySecs (SSO Maximum Expiry in the Admin Console) value (for example, to 1 hour) so that expired/stale sessions are cleared more quickly and no longer count against the session limit (2).
- Increase the maximum number of allowed concurrent sessions per user (SSO Maximum User Sessions in the Admin Console) to accommodate legitimate multi-device (mobile + web) usage (2).
Apply both changes together to prevent users from being blocked by the session cap while sessions age out faster.
Additional Information
Feedback
