Question
Swift
BE
Last activity: 12 Jan 2023 3:41 EST
SSO login in Pega 8 is not working where as normal login works
<< UAT Environment >>
We have Pega 8.1 environment which has sso login enabled.
It has been working with out issues for long time but since yesterday the sso login is giving 500 error where as the normal login with basic auth (username and password to designer studio) working without any issues.
In the logs we are seeing so many errors related to search as well.
like
1.search index failed ....possible cause - master node is not reachable
2. Pega admin studio shows only 1 node where as we have total 2 nodes.
NCS Pte. Ltd
SG
Hi @PavanKumarK9828: Were you able to isolate the logs for the SSO login time period? Also please check with the identity provider if they are able to get anything in the logs.
Regarding the other 2 issues in the logs, I would suggest to shutdown all the nodes and start them one after other.
Thanks.
LTIMindtree
SA
1. Search Indexing Issue:
Perform the below steps when the Indexes are not visible in the Pega Application UI
1. Stop the server (Shutdown Sequence Order to follow: WebUser, Background Processing & Search, Stream) 2. Truncate: PR_SYS_QUEUE_FTSINDEXER table 3. Truncate: pr_log_cluster table 4. Correct entries or remove any wrong node entries in pr_sys_statusnode table 5. Deleted all search indexes folders defined on search landind page 6. Restart server (Startup Sequence Order to follow: Stream, Background Processing & Search & WebUser)
DB Queries to Truncate the Tables:
Truncate table <Data-Schema>.PR_SYS_QUEUE_FTSINDEXER;
Truncate table <Data-Schema>.pr_log_cluster;
It's also advisable to Truncate the below DB Cache Tables when you bring down the system, as a practice:
Truncate table <Data-Schema>.pr_sys_delayed_queue;
Truncate table <Data-Schema>.pr_data_stream_nodes;
Truncate table <Data-Schema>.pr_data_stream_sessions;
Truncate table <Data-Schema>.pr_sys_statusnodes;
Truncate table <Data-Schema>.pr_sys_statusdetails;
Truncate table <Data-Schema>.pr_data_stream_node_updates;
Truncate table <Data-Schema>.pr_perf_stats;
1. Search Indexing Issue:
Perform the below steps when the Indexes are not visible in the Pega Application UI
1. Stop the server (Shutdown Sequence Order to follow: WebUser, Background Processing & Search, Stream) 2. Truncate: PR_SYS_QUEUE_FTSINDEXER table 3. Truncate: pr_log_cluster table 4. Correct entries or remove any wrong node entries in pr_sys_statusnode table 5. Deleted all search indexes folders defined on search landind page 6. Restart server (Startup Sequence Order to follow: Stream, Background Processing & Search & WebUser)
DB Queries to Truncate the Tables:
Truncate table <Data-Schema>.PR_SYS_QUEUE_FTSINDEXER;
Truncate table <Data-Schema>.pr_log_cluster;
It's also advisable to Truncate the below DB Cache Tables when you bring down the system, as a practice:
Truncate table <Data-Schema>.pr_sys_delayed_queue;
Truncate table <Data-Schema>.pr_data_stream_nodes;
Truncate table <Data-Schema>.pr_data_stream_sessions;
Truncate table <Data-Schema>.pr_sys_statusnodes;
Truncate table <Data-Schema>.pr_sys_statusdetails;
Truncate table <Data-Schema>.pr_data_stream_node_updates;
Truncate table <Data-Schema>.pr_perf_stats;
2. Pega Admin Studio Shows Only One Node Issue: upon following the above steps, the Admin Studio Status issue will also be resolved. But Once the system is up, You'll need to review the number of requestor API calls is allowed per custom database type (from Application Side) vs Max DB connections configured in the system (from Database Configurations Side) and increase them upon the need.
3. SSO Login Issue: As per your inputs, SSO was working fine till recent times I understand. whether your service provider be IAM / IDP / OIDC, you'll need to verify if any IP addresses or configuration changes occured on their end and check if any firewall blocking exceptions recorded in the logs. You'll need middleware / Security Team help on this to debug further.
From your end, you'll need to validate on one thing. On Pega Application Security checklist point of view, Cross Site Request Forgery Settings has an option called "Same Site Cookie Attribute" which must be set to "Lax". If it's set to "Strict", you'll encounter the SSO Login issues. for more details, you may refer: SSO-Login Issue - Invalid State Parameter error | Support Center (pega.com)
Note: I have added couple of screenshots which has useful loggers need to enable in your application to debug further on the Serch Indexing issue and SSO Login Issue further.