Extra SSPR login prompt or 5071 error with OSP integration

  • 7016168
  • 09-Feb-2015
  • 20-Jun-2019

Environment

SSPR 3.x
SSPR 4.x
Integrated with OSP (OAuth)
IDM 4.x
eDirectory environment
NMAS universal password policy defined
NAM

Situation

SSPR Error 5071:  An error using the OAuth authentication protocol has occurred.  Please try again later.  5071 ERROR_OAUTH_ERROR
Alternatively, the user may be prompted for password to login to SSPR page after successfully logging into OSP.
SSPR does not trust the OAuth login and presents prompt for second password.


Resolution

One or all of the following actions may be needed.  Try them in the order presented.

1. Apply current updates for SSPRIDM,  OSP, and NAM (if installed).
2. Make sure the OAuth configuration defined in SSPR matches the configuration defined in IDM and/or NAM.  
         Note: these settings are case sensitive.
3. Give the SSPR Proxy User rights to read the universal password (see below).
4. Delete SSPR cache files  (go to \apache-tomcat-<version>\work\ and   delete the catalina folder)
5. Make sure the secrets shared between SSPR and OSP are correct by resetting the OAuth client secret in configupdate.sh, and the OAuth Shared Secret in SSPR Configuration Editor, Settings, Single Sign On, OAuth as shown:





Steps for granting rights to read the password to the SSPR Proxy User:
1. Launch iManager and open "Password Policy" under the "Passwords" plugin
2. Select the desired policy
3. Select Universal Password
4. Open Configuration options
5. Click "Allow the following to retrieve passwords"
6. Click "Insert"
7. Browse to or type in the SSPR Prox user.


Additional Information

Troubleshooting tips:

1. Make sure you can access the SSPR server directly.  Do this by adding the sso=false switch to the SSPR URL, for example, https://www.example.com/sspr/private/Login?sso=false.  For more detail see   https://support.microfocus.com/kb/doc.php?id=7017574

2. Make sure the OAuth settings in the SSPR configuration match EXACTLY with the corresponding settings in UserApp or NAM.   For SSPR, these will be found in Config Editor ⇨  Settings ⇨ Single Sign On (SSO) Client ⇨ OAuth.  Look especially at the URLs, the OAuth Client ID, and the shared secret.  These settings are case sensitive.

3. Download an SSPR troubleshooting bundle that captures the problem.  Search the debug log for “oauth.”  For details on capturing a troubleshooting bundle see https://support.microfocus.com/kb/doc.php?id=7014795



In one case the following was seen in the SSPR error log:

auth.LDAPAuthenticationRequest  unable to retrieve user password from ldap: error reading nmas password: error -1697

http.PwmRequest  5071 ERROR_OAUTH_ERROR (5015 ERROR_UNKNOWN (no available unknown-pw authentication method))