Question
Infosys Ltd
DE
Last activity: 16 Oct 2018 12:03 EDT
WebSSO.SAML error
Hello,
We are having an issue our SAML rule. The error we are getting is:
Failed to retrieve Rule-Service-Rest instance WebSSO.SAML.### using access group PRPC:Unauthenticated
We have published the metadata and we are still getting the error. We are hoping to get any help with this issue we are having.
Thanks,
**Moderation Team has archived post**
This post has been archived for educational purposes. Contents and links will no longer be updated. If you have the same/similar question, please write a new post.
Accepted Solution
Infosys Ltd
DE
It works after a change to pySAMLWebSSOAuthenticationActivity on how the relaystate was handled. It is working after setting the relay state explicitely instead of the one taken from pxReqContextURI
Pegasystems Inc.
IN
If the SAML service that you are trying to connect is in your application, then can you modify the access group in the WebSSO service package to your own application level unauthenticated access group. If it works, include this service package data instance in the RAP rule that you ship with.
Stratosphere Technical Consulting
US
I'm not sure if this is an outstanding problem for the original poster, but we ran into an identical issue upon upgrading from PRPC 7.2.1 to 7.3. The root of the problem seems to be in how Pega has changed the SAML authentication processing in pySAMLWebSSOAuthenticationActivity AND made that a Final rule in the process. It appears that the intent is no longer that you use that as a starting point and make changes, but that you either accept it as-is or write a custom activity that bases off of it. Further, pyEstablishOperatorContext has likewise been made Final.
We managed to get it all working again by reverting pySAMLWebSSOAuthenticationActivity to the OOTB version, though we were forced to keep pyEstablishOperatorContext as overridden locally as the OOTB version doesn't handle situations where an invalid org/division/unit is passed in through the token. We could alternately have overridden pySAMLWebSSOAuthenticationActivity with our own name and then called a custom version of pyEstablishOperatorContext to avoid overriding the Final rule.
Accepted Solution
Infosys Ltd
DE
It works after a change to pySAMLWebSSOAuthenticationActivity on how the relaystate was handled. It is working after setting the relay state explicitely instead of the one taken from pxReqContextURI