Automic Web Interface: "Unexpected Error" Session Logouts and Kerberos SSO Failures in 24.4.4.

Products

• Automic Automation

Issue/Introduction

Following an upgrade to Automic Automation Engine version 24.4.4+HF2, users experience inconsistent Kerberos authentication failures and unexpected session logouts accompanied by an "Unexpected Error" message. These forced disconnects routinely occur within 1-2 minutes of active use.

Environment

 

• Product: Automic Automation Engine

• Release: 24.4.4+HF2

• Component: Automic Web Interface (AWI)

• Operating System: AIX

 

Cause

The Log and HAR file analysis identifies two independent infrastructure root causes:

• Kerberos Authentication Failures: Users belonging to a large number of Active Directory security groups generate oversized SPNEGO/Kerberos tokens. These tokens exceed the default 8 KB HTTP_MAX_HEADER_SIZE limit in the AWI/Jetty web server. The server rejects the request immediately with a 431 Request Header Fields Too Large error before it reaches the Single Sign-On (SSO) logic.

• Unstable Sessions / Unexpected Logouts: A reverse proxy, ingress, or gateway layer situated in front of the AWI pods is intermittently terminating Vaadin heartbeat and push keep-alive calls (/awi/?v-r=heartbeat&v-uiId=N). The proxy's websocket/idle connection timeout is shorter than AWI's configured push timeout. When the proxy rejects a heartbeat (returning 400, 403, or 504 errors along with a custom 17-byte "Unexpected Error" HTML body), the Vaadin UI client loses synchronization and forces a logout dialog, even though the backend server session remains perfectly healthy.

Resolution

To resolve the oversized Kerberos token issue:

• Increase the http.max.header.size variable in the AWI configuration significantly above 8192 bytes (e.g., 32768 or 65536).

• Restart the AWI component to apply the changes.

To resolve the unexpected session logouts:

• Review the configuration of the reverse proxy or load balancer fronting the AWI environment.

• Increase the proxy's websocket and long-poll idle timeout settings so they are larger than AWI's internal push timeout.

• Verify that the proxy is configured to properly pass through X-Forwarded-For headers to ensure accurate client IP logging.

• Identify and adjust the specific security appliance injecting the literal "Unexpected Error\n" custom page on 403 responses.