Skip to main content

This content is closed to future replies and is no longer being maintained or updated.
Links may no longer function. If you have a similar request, please write a new post.

Question

 Varun Chandana (VarunC72)
Infosys Ltd

Infosys Ltd
IN
VarunC72 Member since 2016 9 posts
Infosys Ltd
Posted: Feb 25, 2019
Last activity: Oct 21, 2020
Posted: 25 Feb 2019 12:40 EST
Last activity: 21 Oct 2020 5:18 EDT
Closed

Displaying Login Page for SSO Login

Hi,

We are using SSO Login for our application. But still users are routed to the Pega Login Page Screen even after providing the correct SSO Details. Can you please help on what are the changes to be made to skip pega login page while logging with SSO specified service url-pattern.

Thanks,
Varun

***Edited by Moderator Marissa to update platform capability tags****

To see attachments, please log in.
Low-Code App Development
Data Integration
Security
User Experience

Posted: 5 years ago
Posted: 25 Feb 2019 13:34 EST
Jarek Cora (Jarek)
PEGA
Director, Services Engineering, Live Data
Pegasystems Inc.
PL

If you configured your SSO in Pega using Authentication Service, your end-users need to login by accessing the URL listed as "Login URL" in the authentication service configuration. This URL typically has the format https://{host}/prweb/PRAuth/{alias} where alias is the name you gave to the authentication service. Going to this URL would redirect users to the Idenity  Provider login page instead of Pega login.

Note: If your SSO solution does not use Authentication Service, please disregard this tip.

To see attachments, please log in.
Posted: 5 years ago
Posted: 26 Feb 2019 4:05 EST
Varun Chandana (VarunC72)
Infosys Ltd

Infosys Ltd
IN

Hi Cora,

Thanks for the quick response.

We are using Authentication Service and the users are logging using the URL listed in the authentication service. As you mentioned Going to this URL users are also redirected to the Identity  Provider login page and on providing details there, we are redirected back to PEGA login page. (it should actually take us to the portal but we are redirected to the pega login page in our case).
 

I have checked the Authentication service activities (Time out activity and Authentication activity). But I don’t see anything related to skipping login screen in those activities


So my question is where are we specifying that it should skip the PEGA login page when I am using SSO Authentication Service or is there a way to trace this ?

Thanks,

Varun

To see attachments, please log in.
Posted: 5 years ago
Posted: 26 Feb 2019 9:13 EST
Jarek Cora (Jarek)
PEGA
Director, Services Engineering, Live Data
Pegasystems Inc.
PL

Hi Varun,

You are correct, after successful login to Identity Provider, the user should be redirected to a portal and not to Pega login page.

If you are using OpenID Connect (OIDC) protocol for SSO, then the first thing to check is configuration of your Identity Provider, in particular the value of  "Redirect URI". This should match the redirect URI in your Authentication Service.

If you are using SAML protocol for SSO, you should make sure that "Assertion Consumer Service (ACS)" in your  Identity Provider matches the "Assertion Consumer Service (ACS)" in your Authentication Service.

To see attachments, please log in.
Posted: 5 years ago
Posted: 28 Feb 2019 5:54 EST
Varun Chandana (VarunC72)
Infosys Ltd

Infosys Ltd
IN

Hi Cora,

We are using "Custom" Authentication Service type and i don't think we will have either "Redirect URL" or "ACS" mentioned anywhere in Custom Service Type.

 

To see attachments, please log in.
Posted: 5 years ago
Posted: 28 Feb 2019 6:24 EST
Jarek Cora (Jarek)
PEGA
Director, Services Engineering, Live Data
Pegasystems Inc.
PL

Unfortunately the only use of "Custom" Authentication Service I'm aware of is when credentials are entered in Pega login screen and then verified against some external directory of users, for example LDAP / ActiveDirectory. I have no experience with using "Custom" Authentication Service in a scenario when credentials are entered  in an external Identity Provider and do not reach Pega. 

Maybe other community members can help here.

To see attachments, please log in.
Posted: 4 years ago
Posted: 21 Oct 2020 5:18 EDT
Javvar Mohammad (JavvarM9)
Department of Environment

Department of Environment
IN

Hi Jarek,

Does the PRAuth in the url format is required? or is there a way to get rid of it from the Login URL.

Becuase currently we are using "https://nswpe-dt1.pegacloud.io/prweb/IAC" url for pega login.  Now we are implementing the OpenID connect SSO. So when ever i enter "Authentication service alias" as IAC the URL forming as "https://nswpe-dt1.pegacloud.io/prweb/PRAuth/IAC". But all the end users might have book marked the old URL which will still redirect to the pega login page.  How to do this?  

 

To see attachments, please log in.
Posted: 5 years ago
Updated: 5 years ago
Posted: 24 Nov 2019 22:36 EST
Updated: 26 Nov 2019 0:23 EST
Abhishek Goel (goela1) Technical Solutions Engineer
Pegasystems Inc.
IN

Hi @VarunC72 -

Could you please let us know the root cause if your issue has been resolved?

Thank you,

Abhishek Goel

To see attachments, please log in.
Posted: 5 years ago
Posted: 26 Nov 2019 4:28 EST
Abhishek Goel (goela1) Technical Solutions Engineer
Pegasystems Inc.
IN

Hi,

The issue seems to be with PRAuth. The network should be traced and it might be using host:port/prweb instead to host:port/prweb/PRAuth while redirecting whenever the first GET request hits on browser with SSO URL. 

In order to fix the issue, web.xml file should be updated with <servlet-mappings> and PRAuth should be configured as below.

Show More

Hi,

The issue seems to be with PRAuth. The network should be traced and it might be using host:port/prweb instead to host:port/prweb/PRAuth while redirecting whenever the first GET request hits on browser with SSO URL. 

In order to fix the issue, web.xml file should be updated with <servlet-mappings> and PRAuth should be configured as below.

<servlet>
<servlet-name>PRAuth</servlet-name>
<display-name>PRAuth</display-name>
<description>PRAuth</description>
<servlet-class>com.pega.pegarules.internal.web.servlet.WebStandardBoot</servlet-class>
<init-param>
<param-name>PegaEtierClass</param-name>
<!-- COMPONENTS: This was previously com.pega.pegarules.services.HttpAPI -->
<param-value>com.pega.pegarules.session.internal.engineinterface.service.HttpAPI</param-value>
</init-param>
<init-param>
<param-name>AuthenticationType</param-name>
<param-value>PegaAuthentication</param-value>
</init-param>
<init-param>
<param-name>StatusPage</param-name>
<param-value>/diagnostic/status.jsp</param-value>
</init-param>
<init-param>
<param-name>RuntimeServletName</param-name>
<param-value>PRAuth</param-value>
</init-param>
<init-param>
<param-name>SecureServletName</param-name>
<param-value>PRAuth</param-value>
</init-param>
</servlet>
 
 
<!--  New PegaAuthentication scheme in 7.4 -->
<servlet-mapping>
<servlet-name>PRAuth</servlet-name>
<url-pattern>/PRAuth</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>PRAuth</servlet-name>
<url-pattern>/PRAuth/*</url-pattern>
</servlet-mapping>
<!-- Portlet Servlet, using Pega's Portlet Custom Authentication -->
<servlet-mapping>
<servlet-name>PRPortletService</servlet-name>
<url-pattern>/PRPortletService</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>PRPortletService</servlet-name>
<url-pattern>/PRPortletService/*</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>PRPortletService</servlet-name>
<url-pattern>/PRPortletServiceAuth</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>PRPortletService</servlet-name>
<url-pattern>/PRPortletServiceAuth/*</url-pattern>
</servlet-mapping>

Show Less
To see attachments, please log in.

We'd prefer it if you saw us at our best.

Pega Collaboration Center has detected you are using a browser which may prevent you from experiencing the site as intended. To improve your experience, please update your browser.

Close Deprecation Notice