26.14 Users with very large usergroups attributes are being rejected by the NGINX reverse proxy

Issue: After upgrading to Advanced Authentication 6.4 Service Pack 2, users with very large userGroup attributes are rejected by the nginx reverse proxy and are unable to log in.

Workaround: To resolve the login issue, perform the following steps:

  1. Login to the SSH session on the Advanced Authentication server.

  2. Run the following command to connect to the Aucore container:

    docker exec aaf-aucore-1 bash

  3. Run the following commands to open the authcfg.xml file:

    vi /opt/AuCore/static/osp_templates/WEB-INF/conf/current/tenant/services/authcfg.xml

  4. Set the value of the AttributeMapEntry cachable parameter to “True” in the below elements:

    • <AttributeMapEntry cachable="true" localName="userGroups" nativeName="naafUserGroups"/>

    • <AttributeMapEntry cachable="true" localName="roles" nativeName="user_role_assignments"/>

  5. Save the file and exit the docker container.

  6. Run the following command to remove the .json file from the container:

    rm /var/lib/docker/volumes/aaf_aucore-data/_data/osp_settings.json

    NOTE:Wait for 5 minutes to allow the configuration to be rewritten.