0

Having WSO2 IS 5.0.0.SP1 backed by PostgreSQL there is another application reading user information using the SCIM service (filter=userNameEq...)

All works but after certain time the service returns "User is not authorized.." response with a single ERROR level log line. Since that moment all subsequent calls fail with "404 User is not authorized". Even when I log in using the admin account I have no access rights. This state takes for a few minutes and then all seems working again.

We traced the response message to the SCIM service implementation where the authorization is checked. However we are unable to find the root cause of the issue (suspecting some exception is qietly dropped, cache cleanup cleans more than it should, ...)

Any hint / idea is appreciated.

Carpe diem

Gabriel

Community
  • 1
  • 1
gusto2
  • 11,210
  • 2
  • 17
  • 36
  • Additional information - in the user-mgt.xml we've disabled the authorization cache as we've found when the authorization issue occurs and is remembered in the cache, all subsequent calls fail until the cache is cleared :/ – gusto2 Dec 14 '15 at 15:37

2 Answers2

1

This seems to be authorization issue. If after trying 3 fail login attempt user locked 0-minutes(Most user used 05 minutes). This is default settings of fresh WSO2 IS pack. After the configured locked-time user unlocked. Then the user have a login with valid credentials. If you need, you can change the login attempt,locked time.Please check [IS_HOME]/repository/conf/security/identity-mgt.properties file. It's having the all configuration.

KWick
  • 167
  • 2
  • 10
  • Thank you, in fact the issue is much broader (I'll describe later), but indeed basically it's an authorization issue. – gusto2 Jan 18 '16 at 09:04
0

Issue is resolved (or - reason is identified in another system). In the AD tree one of the domain controllers is external (cloud) and unable to authenticate the technical (wso2) datastore user. When the AD node hostname is resolved to the cloud node, then ldapsearch is unable to return any groups from a sub-domain of the cloud based domain controller (interesting - it doesn't fail).

gusto2
  • 11,210
  • 2
  • 17
  • 36