Page Comparison

Problem

If you are using SSO version 8.9.x and have perfromed key-rotation, when trying to use suomi.fi authentiction method you get Internal Server Error error in browser

...

2022-03-11 13:04:58,078 protocol [11.88.10.98] AuthorizationServlet
com.ubisecure.ubilogin.sso.ui.conversation.authn.AccessDeniedException: Access to the requested resource is denied
	at com.ubisecure.ubilogin.sso.ui.conversation.authn.UbiloginAuthenticationRequest.assertAccessAllowed(UbiloginAuthenticationRequest.java:428)
	at com.ubisecure.ubilogin.sso.ui.conversation.authn.UbiloginAuthenticationRequest.assertAccessAllowed(UbiloginAuthenticationRequest.java:398)
	at com.ubisecure.ubilogin.sso.ui.servlet.AbstractMainServlet.main(AbstractMainServlet.java:201)

Solution

This kind of error occurs if there arent any keys configured to be encryption key. This means that all keys are configured as signing keys and the integration with suomi.fi is probably configured to use encryption.

Panel

bgColor	#fff

You can check if key has added only usage to be -d "use : sig" using below GET method

curl -H "Authorization: Bearer XXXXXX" -X GET https://HOSTNAME/uas/oauth2/metadata.jwks --insecure

Tip

title	HTTP 200 Response

Expand

title	Successfully Fetched key details

{
    "keys": [
        {
            "use": "sig",
            "kid": "sig-key1",
            "kty": "RSA",
            "n": "... redacted ...",
            "e": "AQAB"
        }
    ]
}

You can remove the usage by following command :

curl -H "Authorization: Bearer XXXXXX" -X PUT https://HOSTNAME/sso-api/credential/System/ServerKeyContainer/sig-key1 -d "use= " --insecure

Tip

title	HTTP 200 Response

Expand

title	Successfully created or updated a key

Accept: application/json

Field	Type	Description
`type`	string	The type of the object. Currently this is always set to `credential.`
`id`	string	The unique id of the key.
`attributes.name`	string	The name of the key.
`attributes.kty`	string	The type of the key. For example `RSA`
`attributes.kid`	string	The key identifier as defined by RFC 7517 JSON Web Key specification
`attributes.use`	string	The usage of the key as defined by RFC 7517 JSON Web Key specification. Valid values are `enc` - for encryption `sig` - for signing
`attributes.enabled`	boolean	Denotes whether the key is enabled or not.
`attributes.notBefore`	datetime	The epoch timestamp after which the key is valid.
`attributes.notOnOrAfter`	datetime	The epoch timestamp after which the key is not valid.
`attributes.description`	string array	A human-readable description of the key.

Now the same key will be used as encrypion key as well as sig key.

Versions Compared

Old Version 14

New Version Current

Key

Problem

Solution

Related articles