Web Portal auto-login fails to inject credentials due to dynamic session identifiers in URL - Privileged Access Manager

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

When using the Web Portal (Web HTML SSO) service, auto-login may fail to inject credentials if the target website generates a dynamic session identifier or random string within the URL path at the time of login.

Symptoms

• PAM launches the web browser and navigates to the login page.
• Credentials (Username/Password) are not injected into the fields.
• The browser session eventually times out without logging in.
• PAM Applet/Client logs show a mismatch between currentUrl and expectedUrl (e.g., currentUrl contains a string like /@####/ that changes every session).

Environment

• Privileged Access Manager (PAM) 4.3.x
• Web Portal / TCP/UDP Service (Web HTML SSO)

Cause

This issue occurs because the standard Web SSO framework expects the runtime URL to match the exact URL captured during "Learn Mode." If the site inserts a dynamic session ID (e.g., https://portal.example.com/@8570/login.aspx), PAM cannot validate that it has reached the correct login page, causing the injection engine to wait indefinitely.

Resolution

This behavior is addressed via a code update that allows the injection engine to dynamically handle these session strings.

Fixed Version: The fix is scheduled to be included in the 4.3.2.01 hotfix release.

Workaround: Try with redirected sitehttps://portal.example.com/@1234/login.aspx in place of direct start sitehttps://portal.example.com/login.aspx in Launch URL in PAM Service configuration to see if works

Recommendation: Subscribe to this article to receive updates regarding the availability of the fix by following the steps in KB 275360.

Additional Information

To improve findability, ensure the "Launch URL" in the PAM service configuration does not contain a hardcoded session ID (e.g., use https://portal.example.com/login.aspx instead of https://portal.example.com/@1234/login.aspx).