Security Software

Only one UPN suffix works with OAM plugin for RSA-integrated Authentication while others give "CredentialsRejected" error

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-

Has anyone seen this before and might know the answer? Any suggestions? Thanks!


I have setup an OAM authentication scheme that uses a custom plugin to use RSA ACE server - all pretty much exactly as it is outlined in the chapter called "Integrating the RSA SecurID Authentication Plug-in" in Oracle Access Manager Integration Guide. Here's the problem:


Everything works fine when I use a particular UPN suffix to login to the RSA Securid Login form that is presented, eg. firstname.lastname@OLDUPN.COM, but if I create another user that uses a different UPN suffix as defined in Active Directory, (eg. firstname.lastname@NEWUPN.COM), the credentials are rejected. This happens before the secuirid.pl script even gets a chance to run. After hitting "POST" the user is present with the same login screen he was just at, as expected during an authentication failure.



More info:

- I have performed successful anonymous ldap queries for both users in Active Directory using LDP. Both users exist in the same domain and in the same OU. If I change the UPN (in AD and the RSA database) to something different from the "good" one, on either user, it fails. If I change the UPN to the "good one" on either user (in AD and the RSA database) it works.



- if I test users with either the "good" or the "bad" UPN via the RSA agent tester that sits on the OAM box, both of them show as authenticating successfully. However, it doesn't work for the "bad" UPN when I try to access via a web browser on a remote client (but does work with the "Good" UPN)

- I am not using SSL in any of this yet, it's all http://

- yes, I already got rid of the "-w" parameter in the first line of the perl script, as per the "login can fail if the Login Attribute Contains an "@" Character in Integration Guide Troubleshooting section



- here's an example of the settings in rsa securid authentication scheme:



action:/OracleAccessManager/securid-cgi/securid.pl

form:/OracleAccessManager/securid-forms-adforest/securid-std-login.html

creds:login password domain newpin newpin2

passthrough:yes



authn_securid fullformdir="C:\apache\Apache2\htdocs/OracleAccessManager/securid-forms-adforest/",machine="MyComputer.mydomain.com:80"

credential_mapping obMappingBase="%domain%",obMappingFilter="(&(objectclass=user)(userPrincipalName=%login%))"







Environment:

OAM 7.0.4.3

RSA Ace Server 5.2

Windows 2003 domain with multiple UPNs defined in Active Direcory Domains and Trusts





Error as seen in the oblog.log for the webgate on the server that holds the RSA login pages and perl script:



Message^A plugin for the authentication scheme SecurID Authentication has denied authentication for credentials (login=firstname.lastname@NEWUPN.COM



password=(omitted) domain=dc=ourdomain,dc=com newpin= newpin2= Resource=/OracleAccessManager/securid-cgi/securid.pl RequesterIP=10.250.1.2 Operation=POST).



ReqReq^POST /OracleAccessManager/securid-cgi/securid.pl HTTP/1.1 ReqProto^HTTP/1.1 ReqHost^www.MyComputer.mydomain.com. ReqStatLine^



ReqStatus^200 ReqRawUri^/OracleAccessManager/securid-cgi/securid.pl ReqUri^/OracleAccessManager/securid-cgi/securid.pl



ReqFilename^C:/apache/Apache2/htdocs/OracleAccessManager/securid-cgi/securid.pl ReqPath^ ReqArgs^



2009/07/13@15:19:49.665000 45688 46472 AUTHENTICATION ERROR 0x00001515



\Oblix\coreid\palantir\webgate\src\authentication_event_handler.cpp:1361 "Authentication failed" HTTPStatus^401



authenticationSchemeName^SecurID Authentication AuthenticationStatus^majorCode = 11[CredentialsRejected], minorCode = 47[AuthnPluginDenied],



StatusMsg = , GSN = 0, needInfo = NONE Creds^login=firstname.lastname@NEWUPN.COM password=(omitted) domain=dc=ourdomain,dc=com newpin= newpin2=



Resource=/OracleAccessManager/securid-cgi/securid.pl RequesterIP=10.250.1.2 Operation=POST





Only error seen in log produced by the RSA agent that sits on the Access server:



[20804] 12:27:08.915 File:ACNETSUB.C Line:326 # CheckServerAddress: server 0 detected from address 10.250.88.100

[20804] 12:27:08.915 File:udpmsg.c Line:968 # Entering decrypts_ok_legacy()

[20804] 12:27:08.915 File:udpmsg.c Line:999 # decrypts_ok_legacy: decrypt() wpcode1 failed; wpcode0 next ***********

[20804] 12:27:08.915 File:udpmsg.c Line:1089 # Leaving decrypts_ok_legacy(), result=1

[20804] 12:27:08.915 File:ACEXPORT.C Line:820 # Entering AceGetUserData()

[20804] 12:27:08.915 File:ACEXPORT.C Line:833 # Leaving AceGetUserData() return: ACE_SUCCESS

[20804] 12:27:08.915 File:ACEXPORT.C Line:579 # Entering AceGetAuthenticationStatus()

[20804] 12:27:08.915 File:ACEXPORT.C Line:592 # Leaving AceGetAuthenticationStatus() return: ACE_SUCCESS