Return
-
Title
Users not associated to groups and roles when using Windows Single Sign-On -
Description
Users not associated to groups and roles when using Windows Single Sign-On (SSO).
Users get created when login via SSO but groups are not imported or associated to the users and messageThe user "USER" does not have access to the application. Please contact your administrator to grant necessary permissions.is shown.
The following error is present in the Foglight Management Server (FMS) log:
ERROR [http-exec-3] com.quest.nitro.service.security.auth.spi.NitroSSOLdapLoginService - Create security entities for user "USER" failed.
java.lang.IllegalStateException: java.security.PrivilegedActionException: javax.naming.AuthenticationNotSupportedException: GSSAPI
at com.quest.nitro.service.security.auth.spi.NitroSSOLdapLoginService.getInitialContext(NitroSSOLdapLoginService.java:398)
at com.quest.nitro.service.security.auth.spi.NitroSSOLdapLoginService.loadRoot(NitroSSOLdapLoginService.java:331)
at com.quest.nitro.service.security.auth.spi.NitroSSOLdapLoginService.getUserGroup(NitroSSOLdapLoginService.java:159)
at com.quest.nitro.service.security.auth.spi.NitroSSOLdapLoginService.access$200(NitroSSOLdapLoginService.java:59)
at com.quest.nitro.service.security.auth.spi.NitroSSOLdapLoginService$1$1.run(NitroSSOLdapLoginService.java:119)
-
Cause
The GSSAPI algorithm is not available in the included JDK providers. -
Resolution
WORKAROUND
Add the JdkSASL provider to the list of providers:
- Make a backup of
[FMS_HOME]/config/security/java.windows.security - Edit the file to add
security.provider.12=JdkSASLat the end of the list of provides section; for example:# List of providers and their preference orders (see above): # security.provider.1=SUN (...) security.provider.10=SunMSCAPI security.provider.11=SunPKCS11 security.provider.12=JdkSASL
- Restart the Foglight Management Server (FMS).
STATUSThis issue has been logged as defect FOG-8525. Fixed in Foglight 7.3.0
- Make a backup of
-
Defect ID
FOG-8525