"Unable to Communicate to the PPM server" Intermittently Post SSO implementation

Products

• Clarity PPM On Premise

Issue/Introduction

After implementing Single Sign On (SSO), users are intermittently getting popup errors:

"Unable to Communicate to the PPM server. Please try again and if the problem persists contact your system administrator."

Environment

All Clarity Supported environments using Single Sign On with a Load Balancer front end and/or an Apache Reverse Proxy server.

Cause

Clarity will trap on underlying http status codes that are unexpected (for example: "0") instead of the usual codes of "200", "302", etc. If there is a network disconnect or SSO timeout, or other connection interruption between the client and the server, the web browser will throw an XHR exception with an http status code of "0".The popup will then display to the user.  This is to let the user know that something went wrong and to try again.

To address the issue, reference the <CAPPM_HOME>/logs/app-ca.log at the time the user received the popup. An error will appear with the username of the user that saw the issue:

OnError called--Client Side Exception

java.lang.Exception: VXMLRequest failed.  HTTP status code was: 0

One common cause can be Load Balancer (for example: F5 Networks load balancer) or Apache Web Server - Reverse Proxy server in front of the Clarity application server. Configuration here can cause connections to timeout or become interrupted.

Resolution

Broadcom Support cannot assist with tuning Load Balancers and Reverse Proxy servers. However, the following items can resolve the issue for our On Premise customers.

1. Apache Reverse Proxy configuration file

1. • Tune or add KeepAliveTimeout and set to 30 seconds.
   •  Anything smaller can result in the popup error intermittently.
2. If using an F5, implement a One Connect profile to maintain client connections 
   • For example:  https://www.f5.com/pdf/deployment-guides/oneconnect-tuning-dg.pdf
   • Please consult with your Load Balancer vendor support for assistance.
3. If the issue still persists, please investigate the following:
   • Ensure that the Clarity Timeout is set to "0" or is set smaller than the SSO idle session timeout.
   • Ensure the Load Balancer session persistence does not time out before the SSO or Clarity idle timeouts.
   • Validate that any client side security software is not playing a role.
   • Inspect any web browser plugins and make sure they are removed for testing.

Additional Information

See also Unable to Communicate to the PPM server - List of Known Issues