weblogic启动后，首次尝试SSO登录到weblogic失败。 第二次（及之后）相同的SSO请求成功

Question

My question refers to a previously asked question on stackoverflow which was never answered:

Why does weblogic's "not found" behavior change after the first attempt?

In my case, I'm implementing a SAML solution to log in from the identity provider to the external service provider. The external service provider (ESP) is hosted on weblogic 9.2.3. On my first attempt after i startup weblogic to SSO-login to the ESP service provider, i can see in the logs that the app proceeds to build a redirect url normally. On the response.sendRedirect() call, I see that the ESP has received a new request to the "home login" page -- the page users would be directed to if they weren't logged in. It seems to not know it (the servlet) has already been initialized, and then acts as if there is no login session and forwards to the login form page (as if they've not been logged in). I've checked all the weblogic logs and our application logs, but there's no clue as to why this is happening.

I've seen this on other weblogic sso projects before. It wasn't a problem with those because those other projects typically had a high volume of users logging in through the ESP form before the first SSO request was made. (It only takes one attempt.) Also, because of the volume on previous projects, i wasn't able to consistently reproduce the problem...until now.

The previous stackoverflow post of this nature (which wasn't answered) is the only relevant search result google gives me.

Big thank you to anyone who has some insight as to what the problem is.

Answer 1

Looks like your authentication never worked. Why your subsequent requests are working could be because you are using the same browser session and so the SSO cookie are still alive. So I would suggest you enable following debug directives in your weblogic JVM under debug section.

weblogic -> security -> atn, atz, ldap to start with. Recreate the scenario and look at the log which should tell whether your authentication is successful or failed. You need to also see the server startup logs to see if there is any error related to ldap provider.

Thanks.