Access Manager IDP x509 Tomcat Dual Connector fails with "The Web Browser experienced an error that did not allow it to successfully initiate the request"

• user will access the IDP portal page at https://idpa.kgast.nam.com:8443/nidp/portal
• user selects the x509 authentication card
• browser will receive the redirect to the second connector
  
  HTTP/1.1 302
  Strict-Transport-Security: max-age=31536000
  X-Frame-Options: SAMEORIGIN
  X-Content-Type-Options: nosniff
  X-XSS-Protection: 1; mode=block
  via-ESP: null,NIDPLOGGING.600105004 session33-FDDA41E571F19E079B7298E8F56BAE30, null,NIDPLOGGING.600105004 session33-FDDA41E571F19E079B7298E8F56BAE30,NIDPLOGGING.600105002 session220-FDDA41E571F19E079B7298E8F56BAE30
  Pragma: No-cache
  Cache-Control: no-cache
  Access-Control-Allow-Origin: https://idpa.kgast.nam.com:8443
  Access-Control-Allow-Methods: GET, POST, DELETE, PUT, OPTIONS
  Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
  Access-Control-Allow-Credentials: true
  Access-Control-Expose-Headers: Set-Cookie
  Location: https://certauth.kgast.nam.com:8443/nidp/app/login?id=X509&sid=0&option=credential&sid=0&uiDestination=contentDiv&sid=0
  Content-Length: 0
  
  
• Brower client returns the error message:  "The Web Browser experienced an error that did not allow it to successfully initiate the request"

1. Make sure the Server Certificate has been configured to store both DNS names as subjectAltName
   
   X509v3 Subject Alternative Name:
   DNS:idpa.kgast.nam.com, DNS:certauth.kgast.nam.com, DNS:nam40.kgast.nam.com
   
   
   
2. disable the "httpHeaderSecurity"  from within the "/opt/novell/nam/idp/conf/web.xml" by remarking the complete section <!-- -->
   
   On the NIDP server modify the "/opt/novell/nids/lib/webapp/WEB-INF/web.xml" to make use of the "ALLOW-FROM" and "antiClickJackingUri" directives instead of using "SAMEORIGIN"
   

<!--========================================================================================
  init params description for SameOriginFilter: activate- This activates the filter.
  Specify a value "True" to activate the filter.
========================================================================================= -->

<filter>
    <filter-name>SameOriginFilter</filter-name>
    <description>The NIDP server anti-clickjacking filter.This filter adds 'X-FRAME-OPTIONS: SAMEORIGIN' header to http responses, and prevents cross domain framing of web pages as best as possible depending on browser compatibility.</description>
    <filter-class>com.novell.nidp.servlets.filters.jsp.SameOriginFramingFilter</filter-class>
        <init-param>
            <param-name>activate</param-name>
            <param-value>False</param-value>
        </init-param>
</filter>
<filter-mapping>
    <filter-name>SameOriginFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

<filter>
    <filter-name> httpHeaderSecurity</filter-name>
    <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
    <async-supported>true</async-supported>
    <init-param>
        <param-name>hstsMaxAgeSeconds</param-name>
        <param-value>31536000</param-value>
    </init-param>
    <init-param>
        <param-name>antiClickJackingOption</param-name>
        <param-value>ALLOW-FROM</param-value>
        <!-- <param-value>SAMEORIGIN</param-value> -->
    </init-param>
    <init-param>
        <param-name>antiClickJackingUri</param-name>
        <param-value>*</param-value>
   </init-param>
</filter>

• The redirect header should look now like:
  
  HTTP/1.1 302
  Strict-Transport-Security: max-age=31536000
  X-Frame-Options: ALLOW-FROM *
  X-Content-Type-Options: nosniff
  X-XSS-Protection: 1; mode=block
  via-ESP: null,NIDPLOGGING.600105004 session33-053C9CE88185B31750EF4124364D83BD, null,NIDPLOGGING.600105004 session33-053C9CE88185B31750EF4124364D83BD,NIDPLOGGING.600105002 session220-053C9CE88185B31750EF4124364D83BD
  Pragma: No-cache
  Cache-Control: no-cache
  Access-Control-Allow-Origin: https://idpa.kgast.nam.com:8443
  Access-Control-Allow-Methods: GET, POST, DELETE, PUT, OPTIONS
  Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept, Authorization
  Access-Control-Allow-Credentials: true
  Access-Control-Expose-Headers: Set-Cookie
  Location: https://certauth.kgast.nam.com:8443/nidp/app/login?id=X509&sid=0&option=credential&sid=0&uiDestination=contentDiv&sid=0
  Content-Length: 0
  

Note: Usually it would be better to add both domains to <param-name>antiClickJackingUri</param-name> but this is not possible with the shipped tomcat filter therefore the only option is to set the wildcard "*". This paramter is not mullti - valued as per tomcat documentation