Expand my Community achievements bar.

Applications for the 2024-2025 Adobe Experience Manager Champion Program are open!
SOLVED

Author + SAML integration: getting "Resource / not found" message

Avatar

Level 8

as above.

 

some information/notes:

 

  1. I checked the IDP metadata that was given to me by our Okta team
  2. I checked OSGI config
  3. I checked author dispatcher config
  4. I checked SAML response (using SAML tracer browser plugin) 
  5. I can successfully login to Okta
  6. I read this troubleshooting guide in case I miss something else => How to troubleshoot SAML related issues in AEM | Adobe Experience Cloud
  7. our author is behind a dispatcher and Amazon ELB (this is the flow: me => ELB => dispatcher => AEM author)
  8. encryption is turned off in the OSGI config
  9. I checked the certificate that's been uploaded vs the one provided to me by Okta team

 

Any other ideas on what else to check? Thanks

 

 

 

 

Resource at '/' not found: No resource found

Cannot serve request to / in /libs/sling/servlet/errorhandler/404.jsp
Request Progress:

      0 TIMER_START{Request Processing}
      0 COMMENT timer_end format is {<elapsed microseconds>,<timer name>} <optional message>
      3 LOG Method=GET, PathInfo=null
      4 TIMER_START{handleSecurity}
    541 TIMER_END{536,handleSecurity} authenticator org.apache.sling.auth.core.impl.SlingAuthenticator@2818261b returns true
    746 TIMER_START{ResourceResolution}
   1224 TIMER_END{477,ResourceResolution} URI=/ resolves to Resource=NonExistingResource, path=/
   1228 LOG Resource Path Info: SlingRequestPathInfo: path='/', selectorString='null', extension='null', suffix='null'
   1228 TIMER_START{ServletResolution}
   1230 TIMER_START{resolveServlet(/)}
   1713 LOG {0}: no servlet found
   1718 TIMER_END{487,resolveServlet(/)} Using servlet org.apache.sling.servlets.get.DefaultGetServlet
   1721 TIMER_END{492,ServletResolution} URI=/ handled by Servlet=org.apache.sling.servlets.get.DefaultGetServlet
   1724 LOG Applying Requestfilters
   1726 LOG Calling filter: com.adobe.granite.resourceresolverhelper.impl.ResourceResolverHelperImpl
   1730 LOG Calling filter: org.apache.sling.security.impl.ContentDispositionFilter
   1733 LOG Calling filter: org.apache.sling.i18n.impl.I18NFilter
   1735 LOG Calling filter: com.adobe.granite.httpcache.impl.InnerCacheFilter
   1740 LOG Calling filter: org.apache.sling.rewriter.impl.RewriterFilter

 

 

 

1 Accepted Solution

Avatar

Correct answer by
Community Advisor

In the original message, there is a call via GET.

 

 1721 TIMER_END{492,ServletResolution} URI=/ handled by Servlet=org.apache.sling.servlets.get.DefaultGetServlet

 The Trace log that you have verified, is that for a successful/unsuccessful redirection?

 

Please check the request/error logs, if any GET request has reached for "saml_login"


Aanchal Sikka

View solution in original post

5 Replies

Avatar

Employee Advisor

@jayv25585659 

Can you check following:

At AEM, how path is configured inside OSGI config:
Adobe Granite SAML 2.0 Authentication Handler 

It can be path: /  Or path: /content 

 

At IDP, what is endpoint URL

if path: / then /saml_login is ACS endpoint.
If the path: /content then /content/saml_login is ACS endpoint.

 

Assertion Consumer Service (ACS) url is the endpoint in AEM that consumes SAML response
Following article can be helpful while troubleshooting:
https://labs.tadigital.com/index.php/2017/10/10/saml-single-sign-on-sso-for-aem-authorpublish-part-2...

Avatar

Level 8

the path is setup as "/" which is the default when I pressed the "+" to create a new SAML config.

Avatar

Community Advisor

Hello @jayv25585659 

 

We had a similar issue on a project. Sometimes we received GET request for "saml_login"

The "saml_login" accepts POST not GET, hence the error.

 

So, we blocked the "GET" requests to "saml_login" on author dispatcher. Example:

/0081 { /type "deny" /method "GET" /url "*/saml_login"}


Aanchal Sikka

Avatar

Level 8

I checked the SAML transactions using SAML tracer and in our case, it's using POST. But thanks for the suggestion.

Avatar

Correct answer by
Community Advisor

In the original message, there is a call via GET.

 

 1721 TIMER_END{492,ServletResolution} URI=/ handled by Servlet=org.apache.sling.servlets.get.DefaultGetServlet

 The Trace log that you have verified, is that for a successful/unsuccessful redirection?

 

Please check the request/error logs, if any GET request has reached for "saml_login"


Aanchal Sikka