AEM SSO - Signin issue | Community
Skip to main content
srikanthp689160
srikanthp689160
Level 4
September 30, 2019

AEM SSO - Signin issue

  • September 30, 2019
  • 2 replies
  • 10256 views

Hi,

We are trying to implement SSO in our application using OOTB SAML Handler.

Below is the AEM infrastructure architecture(publish)

2 Publishers

2 Dispatchers

Dispatcher Load Balancer

2 F5

F5 Load Balancer

Azure CDN

The issue which we are facing is, once user successfully logs in we are displaying user first name in header section of page under user icon/avatar. But when user navigates to other pages within the application userid is coming as "anonymous".

We have enabled user synchronization between publishers and once user is successfully authenticated, user node gets created in both publishers.

Sticky session configuration is enabled in publish dispatchers.

Is there anything else that needs to be done so that once user is authenticated, the session remains active?

    This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.

    2 replies

    U
    Adobe Employee
    user05162Adobe Employee
    Adobe Employee
    September 30, 2019

    Setup looks good. User sync will take 30-40 seconds to sync the user, are you trying to browse different pages after sometime?

    Also, Are you securing only a particular subset of the pages using the path field in SAML handler? Is the new page ouside of that path?

    srikanthp689160
    srikanthp689160Author
    Level 4
    September 30, 2019

    Hi JaideepBrar,

    Yes, we are securing only subset of pages, pathfield in SAML Handler and Apache Sling Authentication Service is configured with /content/mycompany/xyz/signin only because of below two reasons

    1. User when trying to access a secure page must be taken to an intermediate page(business requirement) where he is shown a message that he/she needs to Signin or Signup to access the page.

    2. Our organization has multiple business units(BU) which has secure folders, instead of configuring multiple paths under Apache Sling Authentication, we are trying to route it through /content/mycompany/xyz/signin page

    Premkarthic-7WP
    Premkarthic-7WP
    Level 4
    September 30, 2019

    My guess is that content might get cached at dispatcher/CDN level, while serving the content it may come from your dispatcher or cdn cache.

    Try to load that particular header component where you include the logged in username dynamically either by using sling dynamic include (Set up Sling Dynamic Include ) or simple ajax call if your setup allows caching authorized content.

    If you don't want to cache the authorized content, please make the TTL as zero at CDN level and also block the pages from caching at dispatcher level for the required content tree.  You can leverage acs commons (Dispatcher TTL ) or you can use ttl headers at page level.

    If in case you are requirement allows to cache the authorized content then you can look for permission sensitive caching (Caching Secured Content ) along with sling dynamic include for showing the dynamic contents like username, user profile attributes etc.

    Hope this might helps.

      srikanthp689160
      srikanthp689160Author
      Level 4
      October 1, 2019

      Thanks Prem.

      One follow up question while I am trying the above approach - Are sticky session configuration at dispatcher mandatory in case of multiple publish instances?

      If we remove sticky session configuration, when trying to login infinite loop issue is coming up where the url in browser address bar flickers between AEM url and IDP url.

      Am I missing anything here?

      Thanks & Regards,

      Srikanth Pogula.

      Premkarthic-7WP
      Premkarthic-7WP
      Level 4
      October 1, 2019

      Yes Srikant you should have sticky session or you can you can use encapsulated token as an alternative if you expect the user sync going to be happen without any delay. Encapsulated Token Support. Better go with both. sometimes sling distribution delayed due to unexpected issues. For encapsulated token also user should  avilable on both the publish.

      hope this helps.

      Terms & ConditionsAccessibility statement

      Loading footer...