SAML Authentication Requires That Users Login Twice When Accessing the Enforce Server console
Article ID: 175642
Updated On:
Products
Issue/Introduction
Using SSO with Windows Integrated Authtication (WIA) to pass Windows credentials into SSO. When using this service with DLP Enforce they are prompted to use windows credentials, then asked to type in credentials again.
Best practice for SSO is to only use the required authentication types. When using "User name and password", "Password Protected Transport" and "Windows Integrated Authentication" and/or any other accepted authentication type, then any user attempting to login to Enforce with SSO will be prompted for their credentials twice.
Cause
No error message is observed by DLP
If customer is using ADFS for SSO, you may see an event similar to the below in the Windows Event logs
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="AD FS Tracing" Guid="{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}" />
<EventID>68</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x8000000000002000</Keywords>
<TimeCreated SystemTime="2019-02-20T19:59:15.572363600Z" />
<EventRecordID>313</EventRecordID>
<Correlation ActivityID="{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}" />
<Execution ProcessID="4980" ThreadID="9912" ProcessorID="2" KernelTime="3" UserTime="11" />
<Channel>AD FS Tracing/Debug</Channel>
<Computer>SERVER_NAME</Computer>
<Security UserID="X-X-X-XX-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-XXXXXX" />
</System>
- <UserData>
- <Event xmlns="http://schemas.microsoft.com/ActiveDirectoryFederationServices/2.0/Events">
<EventData>The SSO token is not valid. Dropping it...</EventData>
</Event>
</UserData>
</Event>
Resolution
This can be resolved by updating the SpringSecurityContext.xml file and commenting out everything but WIA.
<property name="authnContexts">
<list>
<!-- User name and password -->
<!-- value>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</value -->
<!-- Password Protected Transport -->
<!-- value>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</value -->
<!-- Integrated Windows Authentication -->
<value>urn:federation:authentication:windows</value>
<!-- One time token or two factor authentication -->
<!-- value>urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken</value -->
<!-- Any authentication method that your IDP supports -->
<!--value>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</value-->
</list>
</property>The default location for the SpringSecurityContext.xml
In DLP 15.1 and above:
\Program Files\Symantec\DataLossPrevention\EnforceServer\15.5\Protect\tomcat\webapps\ProtectManager\WEB-INFIn DLP 15.0 and below:
\SymantecDLP\Protect\tomcat\webapps\ProtectManager\WEB-INF
Feedback
