Skip to main content

This content is closed to future replies and is no longer being maintained or updated.
Links may no longer function. If you have a similar request, please write a new post.

Question

 Maarten Veger (MaartenBPM)
BPM Company
Practice lead & Pega CLSA
BPM Company
NL
MaartenBPM Member since 2013 14 posts
BPM Company
Posted: Jul 6, 2018
Last activity: Sep 19, 2018
Posted: 6 Jul 2018 7:53 EDT
Last activity: 19 Sep 2018 5:02 EDT
Closed

Issue while setting up SAML authentication: ArrayIndexOutOfBoundsException in java method populatePOSTBodyParams / processSSOResponse

Issue

We are setting up SAML authentication in Pega 7.4.0 with an external Identity Provider on Dev environment. Pega succesfully routes the user to the identity provider and the user also gets succesfully redirected back to the Service Provider (our Pega application).

Then the OOTB REST service AssertionConsumerService (for POST method) gives a 500 status code (Internal Server error). While analyzing, we found out that the OOTB service activity pzAssertionConsumerServiceV2Activity gives an ArrayIndexOutOfBoundsException in step 1. This activity only contains java:

SAMLUtils samlutils = pega.getSAMLUtils();
samlutils.processSSOResponse(tools, myStepPage);

The stack trace indicates the ArrayIndexOutOfBoundsException happens in java method populatePOSTBodyParams. We are a bit stuck now.

Show More

Issue

We are setting up SAML authentication in Pega 7.4.0 with an external Identity Provider on Dev environment. Pega succesfully routes the user to the identity provider and the user also gets succesfully redirected back to the Service Provider (our Pega application).

Then the OOTB REST service AssertionConsumerService (for POST method) gives a 500 status code (Internal Server error). While analyzing, we found out that the OOTB service activity pzAssertionConsumerServiceV2Activity gives an ArrayIndexOutOfBoundsException in step 1. This activity only contains java:

SAMLUtils samlutils = pega.getSAMLUtils();
samlutils.processSSOResponse(tools, myStepPage);

The stack trace indicates the ArrayIndexOutOfBoundsException happens in java method populatePOSTBodyParams. We are a bit stuck now.

Caused by: java.lang.ArrayIndexOutOfBoundsException: 1
at com.pega.pegarules.integration.engine.internal.sso.saml.SAMLv2ACSHandler.populatePOSTBodyParams(SAMLv2ACSHandler.java:459) ~[printegrint.jar:?]
at com.pega.pegarules.integration.engine.internal.sso.saml.SAMLv2ACSHandler.executePostBindingFlow(SAMLv2ACSHandler.java:368) ~[printegrint.jar:?]
at com.pega.pegarules.integration.engine.internal.sso.saml.SAMLv2ACSHandler.processSAMLResponse(SAMLv2ACSHandler.java:71) ~[printegrint.jar:?]
What we tried to find out the issue
- Enable service monitoring on the WebSSO to catch the incoming request (SAML assertion data) to the REST service. Use Base64 Decode + Inflate to see (partly) what was in the message;
- Enabled DEBUG logging on classes Rule_Obj_Activity.pzAssertionConsumerServiceV2Activity.Data_Admin_Security_SSO_SAML.Action and com.pega.pegarules.session.internal.mgmt.authentication. This gave no extra information;
- Run the REST service and then trace it. Seeing a FAIL on step 1 with message Error while executing SAML SSO flow : 1;
- Making some changes to the authentication service rule.
Any suggestions to debug this further?
***Edited by Moderator Marissa to update platform capability tags***

Show Less
To see attachments, please log in.
Java and Activities
Data Integration
Security

Posted: 6 years ago
Posted: 10 Jul 2018 0:17 EDT
Srikanth Challapilla (Srikanth)
PEGA
Senior Manager, Security Engineering
Pegasystems
IN

Hi, can you use SAML tracer chrome plug-in to capture the SAML response?

Also, can you enable debug logging for com.pega.pegarules.integration.engine.internal.sso.saml.SAMLv2ACSHandler

Look for "Received request for Assertion Consumer Service with body content" in the logs. Please share the log message. 

 

To see attachments, please log in.
Posted: 6 years ago
Posted: 10 Jul 2018 2:10 EDT
Maarten Veger (MaartenBPM)
BPM Company
Practice lead & Pega CLSA
BPM Company
NL

Hi Srikanth,

thanks for you answer. I didn't find any SAML tracer chrome plug-in, but I found SAML Chrome Panel, SAML Message Decoder and SAML DevTools extension. Do you want to see the encoded message from the log, or (part of) the decoded message? For now, sharing the decoded AttributeStatement where I changed the name.

    <saml:AttributeStatement>
      <saml:Attribute Name="urn:mace:dir:attribute-def:uid"
                      NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml:AttributeValue xsi:type="xs:string">someuser</saml:AttributeValue>
      </saml:Attribute>
      <saml:Attribute Name="urn:oid:0.9.2342.19200 Proprietary information hidden"
                      NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
        <saml:AttributeValue xsi:type="xs:string">someuser</saml:AttributeValue>
      </saml:Attribute>
    </saml:AttributeStatement>

 

To see attachments, please log in.

We'd prefer it if you saw us at our best.

Pega Collaboration Center has detected you are using a browser which may prevent you from experiencing the site as intended. To improve your experience, please update your browser.

Close Deprecation Notice