SAML login in AEM6.1 ended up with 500 not modifiable error and some times infinite loop

9 replies
7133 views
Translate

Am trying to do a SAML login configuration with OKTA, am able to get the SAML assertion from OKTA after the login but when i comes back to the AEM ended up with the below error. And also some times am ended up with infinite loop. Does any one has done the SAML successfully with OKTA give some limelight over here.

Even i have configured the SAML redirect to my AEM with content/xyz/pages/saml_login

06.04.2016 16:03:24.455 *ERROR* [0:0:0:0:0:0:0:1 [1459938804446] POST /content/geometrix/ae/en/pages/index/saml_login HTTP/1.1] org.apache.sling.servlets.post.impl.operations.ModifyOperation Exception during response processing. javax.jcr.RepositoryException: org.apache.sling.api.resource.PersistenceException: Resource at '/content/etihadguest/ae/en/pages/index/saml_login' is not modifiable.

Thank you.

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.

K

KkkrishAccepted solution

Level 4

Thank you. This got solved after correcting the "Service Provided Entity ID"

chirags8739021

Level 2

Resolved.

Issue :- I have added ".html" in the acs url. After removing .html it works for me.

I break my head for three days to get this done

Translate

chirags8739021

Level 2

Hi,

We are also facing the same issue.

I have tested above mention all points but still getting the same error.

org.apache.sling.api.resource.PersistenceException: Resource at '/content/###/us/en/saml_login' is not modifiable.

Thanks in advance.

Translate

atout100204180

New Participant

FWIW I ran across this same issue on 6.5 with a 500 error and it was not due to the entity id, here was my resolution:

make sure your SAML assertion url (assertionConsumerServiceURL) is beneath your path (path)
- so if your path is /content/somepage
- then your assertion url needs to be: https://yoursite.net/content/somepage/saml_login
- the IDP MUST also have this URL configured correctly.
Make sure your dispatcher is set up correctly, I needed the following
- /0031 { /method "POST" /url "*/saml_login" }
- /0032 { /type "allow" /url "*/saml_login" }
- /0033 { /type "allow" /path "/saml_login*" }
Make sure Sling Referrer Filter has the IDP listed
Make sure you have added your path to the Sling Authentication service if it is not already
- IE: +/content/somepage
Lastly, on my instance the "everyone" user did not have access to read "/" - enable this.