Environment
SSPR 3.x
SSPR 4.x
Integrated with OSP (OAuth)
IDM 4.x
eDirectory environment
SSPR 4.x
Integrated with OSP (OAuth)
IDM 4.x
eDirectory environment
NMAS universal password policy defined
NAM
Situation
SSPR Error 5071: An error using the OAuth authentication protocol has occurred. Please try again later. 5071 ERROR_OAUTH_ERROR
Alternatively, the user may be prompted for password to login to SSPR page after successfully logging into OSP.
SSPR does not trust the OAuth login and presents prompt for second password.
SSPR does not trust the OAuth login and presents prompt for second password.
Resolution
One or all of the following actions may be needed. Try them in the order presented.
2. Make sure the OAuth configuration defined in SSPR matches the configuration defined in IDM and/or NAM.
Note: these settings are case sensitive.
3. Give the SSPR Proxy User rights to read the universal password (see below).
4. Delete SSPR cache files (go to \apache-tomcat-<version>\work\ and delete the catalina folder)
5. Make sure the secrets shared between SSPR and OSP are correct by resetting the OAuth client secret in configupdate.sh, and the OAuth Shared Secret in SSPR Configuration Editor, Settings, Single Sign On, OAuth as shown:
Steps for granting rights to read the password to the SSPR Proxy User:
4. Delete SSPR cache files (go to \apache-tomcat-<version>\work\ and delete the catalina folder)
5. Make sure the secrets shared between SSPR and OSP are correct by resetting the OAuth client secret in configupdate.sh, and the OAuth Shared Secret in SSPR Configuration Editor, Settings, Single Sign On, OAuth as shown:
Steps for granting rights to read the password to the SSPR Proxy User:
1. Launch iManager and open "Password Policy" under the "Passwords" plugin
2. Select the desired policy
3. Select Universal Password
4. Open Configuration options
5. Click "Allow the following to retrieve passwords"
6. Click "Insert"
7. Browse to or type in the SSPR Prox user.
2. Select the desired policy
3. Select Universal Password
4. Open Configuration options
5. Click "Allow the following to retrieve passwords"
6. Click "Insert"
7. Browse to or type in the SSPR Prox user.
Additional Information
Troubleshooting tips:
1. Make sure you can access the SSPR server directly. Do this by adding the sso=false switch to the SSPR URL, for example, https://www.example.com/sspr/private/Login?sso=false. For more detail see https://support.microfocus.com/kb/doc.php?id=7017574
2. Make sure the OAuth settings in the SSPR configuration match EXACTLY with the corresponding settings in UserApp or NAM. For SSPR, these will be found in Config Editor ⇨ Settings ⇨ Single Sign On (SSO) Client ⇨ OAuth. Look especially at the URLs, the OAuth Client ID, and the shared secret. These settings are case sensitive.
3. Download an SSPR troubleshooting bundle that captures the problem. Search the debug log for “oauth.” For details on capturing a troubleshooting bundle see https://support.microfocus.com/kb/doc.php?id=7014795
auth.LDAPAuthenticationRequest unable to retrieve user password from ldap: error reading nmas password: error -1697
http.PwmRequest 5071 ERROR_OAUTH_ERROR (5015 ERROR_UNKNOWN (no available unknown-pw authentication method))