[RESOLVED] SSO self-service not working for all users

[tux]

Wapt Linux 2.4 server.
Windows 10 client

Hello,

SSO on the self-service portal works with some Active Directory accounts but not with others on the same PC.

On the account where it doesn't work, it asks for the account login and password.
Once the credentials are entered, the user has access to the self-service portal, but they have to log in again each time.

Do you have any ideas? Are there any specific logs I should look at?



On the waptserver.ini side, the following parameters are correctly filled:
ldap_account_service_login = XXXXXX
ldap_account_service_password = XXXX
ldap_auth_server = XXXXXX
ldap_auth_base_dn = XXXXX
use_kerberos = True
ldap_auth_ssl_enabled = True
use_ssl_client_auth = True


On the client side, in the agent configuration, I have:
service_auth_type = waptserver-ldap
use_kerberos = True

[tux]

Hello,

after investigation, the problem is related to the Kerberos ticket size.
SSO on the self-service portal seems to have a Kerberos ticket size limit that is smaller than that of Windows.

[sfonteneau]

Hello,

thank you for your feedback.

Could you tell me if the user experiencing the problem accessing the URL https://srvwapt.mydomain.lan/api/v3/login_kerberos works from Firefox?

Note that in Firefox, you need to add the following to about:config:

network.negotiate-auth.delegation-uris mydomain.lan and
network.negotiate-auth.trusted-uris mydomain.lan.

This will help us determine if the issue lies with the nginx spnego module or with waptself.

[tux]

With a user who has a small Kerberos ticket, there's no problem.

With a user who has a large Kerberos ticket:

400 Bad Request
Request Header Or Cookie Too Large
nginx

[sfonteneau]

Based on the message, you can try adding the following to your Nginx configuration: `

large_client_header_buffers 4 16k;

` https://stackoverflow.com/questions/651 ... 7#65151807

If that works, we'll see about modifying the initial Nginx configuration of Wapt.

[tux]

Yes, it works.

Thank you

[sfonteneau]

Thanks, we just added the nginx configuration to the git branch master code here to handle the case.