Question
Cognizant Technologies Solutions US
CA
Last activity: 10 Jun 2022 10:15 EDT
SSO implementation on AES Tenant URL
Hello Team,
We are using on-premises AES ( v8.3) for which we want to implement SSO and it got achieved. SSO works good on AES URL but not on AES Tenant URL.. in Tenant SAMLAuth service SSO URL got automatically generated but it's not working ( at least not even trying to redirect to SSO provider URL... it keeps throwing below msg).
@WERDA will you please help us here
when we hit SSO url which got autogenerated in Tenant SAMULAuth it considers different tenants and gives the exception "com.pega.pegarules.pub.context.PRSecurityException: Undefined tenant configuration"
-----
There has been an issue; please consult your system administrator
Status:fail
Operator:Unauthenticated or not available
Node:No ID available
------
***Edited by Moderator Marije to update Product details as 'Platform' for AES 8.3.1***
Pegasystems Inc.
GB
@SREECHARAN could you take a look at the following:
https://community.pega.com/support/support-articles/unable-access-tenant-url-83
Do you have Pega 8.3.1 installed?
Cognizant Technologies Solutions US
CA
@MarijeSchillern we are using AESv8.3.1... here the issue is with the tenant SSO URL, not the tenant non-sso URL. Above given article talks about 500/403 exception with the tenant url ( hope it might be with non-sso url).
Pegasystems Inc.
GB
@SREECHARAN SSO access to PDC tenants is already available in PDC.
Your question is about AES but our recommendation would be to switch to PDC - you would get SSO implementation included:
Cognizant Technologies Solutions US
CA
@MarijeSchillern sorry to say, we won't be able to adopt/switch PDC.
Pegasystems Inc.
US
@SREECHARAN One should be able to build SSO for AES in same manner as SSO for any multiTenant system. In PDC we have added a wizard to make it easy to create tenant-specific SSO integrations but we have two SSO implementations defined at shared layer that work for all tenants. At a glance, the exception suggests that the IDP is 'mangling' the tenant hash in redirect URL but more debugging is required. Please follow up on this question as a platform issue - there's nothing explicit in AES to support or not support SSO. I know one can create a shared SSO on platform 8.3; I've done several versions of it but its not a PDC-specific issue
Cognizant Technologies Solutions US
CA
@WERDA thanks for the response Andy. We tried either implementing SSO at the tenant layer but still, we are getting the same exception. We even raised SR but GCS said they won't support it.
Pegasystems Inc.
US
Push back to GCS. Fundamental purpose of multiTenancy is to allow each customer/client to have a separate tenant and each customer/client will certainly have their own SSO. PDC service has both shared/common SSO for Pega staff to access PDC and for access to PDC via integration with MySupportPortal and tenant specific SSO, neither of which I would say is PDC-specific at core. Ignore AES in support ticket if it makes it simpler - you're just talking about help debugging SSO
Pegasystems Inc.
GB
@SREECHARAN please can you provide the support ticket INC/ SR id you logged so that we can help track this with you?