topic Re: SSO is a pain in All Things Community

SSO is a pain

ChrisNZ — Mon, 01 Aug 2016 10:51:03 GMT

I haven't had this issue for a while and now it's back.

Could we have a "login again" button when SSO fails rather than the connetion being cut off?

It's impossible to log in from then on.

Re: SSO is a pain

Kurt_Bremser — Mon, 01 Aug 2016 11:03:15 GMT

+1 for this.

I often have to switch browsers on my tablet, unless I want to clear the whole browser history.

On a desktop I can selectively clear cookies for sas.com, at least in PaleMoon.

Re: SSO is a pain

Reeza — Mon, 01 Aug 2016 12:07:07 GMT

I get it every Sunday, so I assume there's some process that runs then and logs everyone off?

Usually restarting browser makes it go away, But a way to avoid error would be useful.

Re: SSO is a pain

Haikuo — Mon, 01 Aug 2016 15:04:18 GMT

Glad I finally found my treatment group :).

Re: SSO is a pain

ChrisHemedinger — Mon, 01 Aug 2016 18:11:43 GMT

Thanks for this feedback -- I'll check with our IT folks to see what might be going on.

I also saw it a couple of times during the weekend (from a home machine), but chalked it up to weekend work. When I refreshed I was logged in, no problem. Now that I see others are seeing issues, I'll pursue it.

Re: SSO is a pain

PaulHomes — Tue, 02 Aug 2016 01:12:34 GMT

I saw that error earlier this week too (Sunday or Monday I think) and had to switch to a different browser to login. I used to get that error quite regularly just after communities switched over from Jive to Lithium, but haven't seen it for a while now.

Re: SSO is a pain

ChrisHemedinger — Wed, 03 Aug 2016 12:34:33 GMT

I've raised this issue with our IT group and they are investigating. Like many tech problems, this is difficult to replicate. However, the good news is that I've seen the same problem from home (but not at work). I've been able to capture some network logs for the team.

You're not supposed to see the HTTP 500 error, but your SAS profile login (used for communities) can "expire" after 7 days (assuming you selected the "keep me logged in" option). The state is tracked using cookies. When your login cookie expires, you should see the user/pw challenge for SAS profile.

Normal tech support advice is "delete all of your cookies". I like to take a more surgical approach.

In Chrome, you can find just your SAS-related cookies:

New tab, visit chrome://settings/search#cookies
Click "All cookies and site data"
Search for "sas.com"
Delete just those cookies

Firefox is a little different:

Paste this in your address bar: about:preferences#privacy
Click remove individual cookies
Search for sas.com, remove those cookies.

Hopefully this is a one-time action on your part. But we'll continue to look into it from our side.

Chris

Re: SSO is a pain

Reeza — Wed, 03 Aug 2016 13:43:36 GMT

@ChrisHemedinger it happens every Sunday.

Re: SSO is a pain

Reeza — Wed, 03 Aug 2016 13:44:15 GMT

And across all devices. Laptop, desktop and tablet/iPad.

Re: SSO is a pain

Kurt_Bremser — Wed, 03 Aug 2016 13:51:58 GMT

The problem comes with the browsers of mobile devices. These often don't have the granularity in deleting the browser history that you get on desktops. You can only remove everything, including all data from other websites.

Re: SSO is a pain

Reeza — Wed, 03 Aug 2016 14:03:33 GMT

@Kurt_Bremser Restarting my browser always works, though it's annoying.

For my iPad that's just swiping up.

Re: SSO is a pain

Tom — Wed, 03 Aug 2016 14:11:43 GMT

Normal tech support advice is "delete all of your cookies".

Can't they just make it smart enough to re-direct to the login page and re-create the cookie when it is expired?

I find that if I close all browser windows and then try again it will successfully go to the logon page. I find that much easier than trying to locate the cookie to delete.

Re: SSO is a pain

ChrisHemedinger — Wed, 03 Aug 2016 15:31:06 GMT

@Tom, yes, that's the design -- it is supposed to be smart enough to renew your login (prompting you to sign in as needed). But since that's sometimes not working, I offered the "delete cookie" approach as a temp fix for people who see this chronically. In the meantime, our IT staff is looking into it.

Re: SSO is a pain

Tom — Wed, 17 Aug 2016 13:00:25 GMT

Today I was able to clear the error by going to http://support.sas.com and signing out.

Then SAS Communities website started working again.

Re: SSO is a pain

ChrisHemedinger — Wed, 17 Aug 2016 14:04:13 GMT

Thanks Tom -- we're still tracking this. Our IT folks think they have a patch, but it's a coordinated process to roll it out. Our single-signon is used by a bunch of systems at SAS.

Re: SSO is a pain

PaulHomes — Sun, 21 Aug 2016 23:58:22 GMT

Not sure if the patch has been rolled out yet, but I just got the HTTP 500 error again (it's Monday morning in Australia).

Re: SSO is a pain

Reeza — Tue, 13 Sep 2016 05:24:27 GMT

I've been getting 401 errors over the past few days. More than usual.

Re: SSO is a pain

Reeza — Tue, 13 Sep 2016 05:32:11 GMT

Re: SSO is a pain

ChrisHemedinger — Tue, 13 Sep 2016 13:53:30 GMT

Still working on it @Reeza. Our weekend attempt to patch this failed some tests, so it was rolled back. I think attempt #2 is scheduled for late this week.

Re: SSO is a pain

Kurt_Bremser — Wed, 21 Sep 2016 05:55:10 GMT

Just had the failure once again. Cleaned out all cookies from sas.com and communities.sas.com to get a clean login form.