After logging in IDP through SAML auth IDP POST to /saml_login URL returns 403 response | Community
Skip to main content
A
andrija_sm
New Participant
March 8, 2023
Solved

After logging in IDP through SAML auth IDP POST to /saml_login URL returns 403 response

  • March 8, 2023
  • 2 replies
  • 1105 views

SAML Authentication configured by following this guide:

https://wttech.blog/blog/2019/how-to-setup-aem-publish-saml-authentication-using-okta

 

and after logging in IDP the POST request to configured URL returns unauthorized 403.

http://aem-publish-host/content/......./login.html

 

Dispatcher has a filter configured to allow POST request on given path 

/0053 { /type "allow" /method "POST" /url "*/login.html" } # allow post for SAML

 

What other options are there to investigate? 

Thanks

 

 

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by andrija_sm

Thanks, I've added "Allow Empty" referrer according to the link you kindly provided. This cleared the 403 error.

However now - accessing login.html enters into a loop of constantly redirecting to sso/saml IDP login page.

There is nothing in SAML logs:

08.03.2023 15:40:22.581 *INFO* [CM Event Dispatcher (Fire ConfigurationEvent: pid=com.adobe.granite.auth.saml.SamlAuthenticationHandler.f94668b4-8ce0-483a-98d0-46025b2c2cd6)] com.adobe.granite.auth.saml Service [com.adobe.granite.auth.saml.SamlAuthenticationHandler.f94668b4-8ce0-483a-98d0-46025b2c2cd6,80376, [org.apache.sling.auth.core.spi.AuthenticationHandler]] ServiceEvent REGISTERED

 

2 replies

A
AlbinIs1
New Participant
March 8, 2023

The 403 issues can be triggered when the Referrer Filter rejects the request; you may need to configure the Referrer Filter based on the IDP configurations.

Refer to Exceptions/Issues while configuring SAML Authentication Handler - Adobe Experience Manager(AEM) (albinsblog.com) for more details.

Regards

Albin

https://www.albinsblog.com

 

    A
    andrija_smAuthorAccepted solution
    New Participant
    March 8, 2023

    Thanks, I've added "Allow Empty" referrer according to the link you kindly provided. This cleared the 403 error.

    However now - accessing login.html enters into a loop of constantly redirecting to sso/saml IDP login page.

    There is nothing in SAML logs:

    08.03.2023 15:40:22.581 *INFO* [CM Event Dispatcher (Fire ConfigurationEvent: pid=com.adobe.granite.auth.saml.SamlAuthenticationHandler.f94668b4-8ce0-483a-98d0-46025b2c2cd6)] com.adobe.granite.auth.saml Service [com.adobe.granite.auth.saml.SamlAuthenticationHandler.f94668b4-8ce0-483a-98d0-46025b2c2cd6,80376, [org.apache.sling.auth.core.spi.AuthenticationHandler]] ServiceEvent REGISTERED

     

      arunpatidar
      arunpatidar
      New Participant
      March 8, 2023

      Please check dispatcher rules for SAML

      https://techrevel.blog/2021/02/01/configuring-aem-for-single-sign-on-via-azure-ad/ 

      Arun Patidar
        A
        andrija_smAuthor
        New Participant
        March 8, 2023

        Thanks Arun, for the quick reply. Unfortunately no new information on that resource.

          Terms & ConditionsAccessibility statement

          Loading footer...