Authentication failed error after some idle time for Azure SSO

[akhilraj]

Hi,

We have configured Azure SSO implementation in our production site.

But we noticed that if we keep the window idle for almost 3 to 4 hours and refresh the page, it is showing as "Authentication failed" error.

It is getting resolved, if we click on the address bar and press enter, or open the page in a different tab or window.

Any idea, how we can solve it?

[akhilraj]

Also once we get this error,

we are getting below info in the Response header:

1. Server:Apache
2. X-Reason:Authentication Failed
   If the sso session is timed out, is there any way we can redirect user to sign in page of SAML again ?

[arunpatidar]

Hi @akhilraj 
I am just sharing one of the custom implantation we did using oAuth(we did not used SAML), where we have created a service that check users session every 5 minutes(using ajax request) and if session(AEM or Azure) expired redirect user to logout page.

I am not sure in your case what is showing Authentication failed content.

you can also check https://learn.microsoft.com/en-us/answers/questions/1041674/configure-redirect-for-failed-silent-sam... 

[akhilraj]

Hi @arunpatidar ,

In our case we can see that error is coming from Apache with X-reason as authentication failed and it is a 403 forbidden.

Even hit is not going to publishers and no logs also generating in AEM side.

I believe something to do with dispatcher level, correct me if i am wrong

[arunpatidar · Accepted solution]

Is there any async call that is keep checking the session after some interval?
You can probably check this by removing sso cookie.
I just wanted to check if there is a call from Azure SSO or your code, which does check session periodically .

[arunpatidar]

I checked the same in local, when I remove try to access the CRXDE and there is no session then I can see the same error. So I believe this error is from AEM in your case.

[akhilraj]

Yea, I am also thinking same. But if we get the place from where this message is coming, either we can provide more meaningful message to user.

In our case when SAML SSO session  is timed out, user will get it.

Do you have idea, whether we can customize this error message or is it possible to redirect to a new page when we get this error?

[arunpatidar]

I think it is from

Referer:

http://localhost:4502/libs/granite/core/content/login.html?resource=%2Fcrx%2Fde%2Findex.jsp&$$login$...