SSO Integration Failures When Using Auth/AZ Mapping - Identity Manager
search cancel

SSO Integration Failures When Using Auth/AZ Mapping - Identity Manager

book

Article ID: 4689

calendar_today

Updated On:

Products

CA Identity Manager CA Identity Governance CA Identity Portal

Issue/Introduction

When Identity Manager is integrated with Single Sign-On (SSO) using authentication and authorization (Auth/AZ) mapping, users may encounter a "File Not Found" error in their browser. Concurrently, the application server logs will display the following error: Header userDN and session spec users do not match

Environment

Identity Manager 14.5

Integrated with Single Sign-On using Authentication/Authorization mapping.

Cause

By default, the ValidateHeadersWithPS parameter is enabled in the Identity Manager configuration. When integrated with SSO, the SiteMinder header transmits the user's full Distinguished Name (DN). However, when Auth/AZ mapping is active, Identity Manager receives only the user ID rather than the full DN. This mismatch triggers a validation failure, as the system expects the header to match the full DN.

Resolution

To resolve this mismatch, you must disable the ValidateHeadersWithPS parameter.

  1. Stop the application server.
  2. Locate the ra.xml file in your deployment directory:
    • Path: [DEPLOYMENT_DIR]/iam_im.ear/policyserver.rar/META-INF/ra.xml
  3. Open ra.xml in a text editor.
  4. Locate the ValidateHeadersWithPS config-property and set the Enabled value to false.
  5. Start the application server.

WebSphere Specific Instructions If you are running Identity Manager on WebSphere, additional steps are required:

  1. Locate the ra.xml file at: [WEBSPHERE_HOME]/AppServer/profiles/[PROFILE_NAME]/config/cells/[CELL_NAME]/applications/iam_im.ear/deployments/IdentityMinder/policyserver.rar/META-INF/ra.xml.
  2. Follow the standard disabling steps listed above.
  3. Update the policy server object in the WebSphere Administrative Console to mirror the changes made in the ra.xml file.

Additional Information

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.

Powered by Wolken Software