SSO between Portal 6.1 and QuickR 8.1   

Hi,

We are running Portal 6.1 and are trying to set up Single Sign On to Domino QuickR 8.1 but it doesn't appear to be working. We've followed the instructions in the info centre to export the LTPA token and imported it into the Domino server, but when we try to view the places from the My Places portlet, we get the following output telling us that the LTPA token is invalid.

SSO appears to be working as if we log into the Portal then change the URL to the QuickR server, we are signed on. However, if we do it in reverse (sign in to QuickR and then change URL to Portal) is prompts for a logon. So it looks like SSO isn't working properly, but we have been unable to figure out why.

Has anyone managed to get SSO between Portal 6.1 and Domino QuickR 8.1 using the My Places portlet to work?

08/09/2008 11:48:17.16 PM 0698:0015-021C HTTP Sessions> Looking for single sign-on session cookie in session cache
08/09/2008 11:48:17.16 PM 0698:0015-021C HTTP Sessions> Single sign-on session cookie not found in cache, decoding. ORG=, CFG=LtpaToken
08/09/2008 11:48:17.16 PM 0698:0015-021C HTTP Sessions> Validating single sign-on session token list
08/09/2008 11:48:17.16 PM 0698:0015-021C SSO API> *** Validating Token List (SECTokenListValidateAndGetInfo) ***
08/09/2008 11:48:17.16 PM 0698:0015-021C SSO API> ConfigName specified LtpaToken.
08/09/2008 11:48:17.16 PM 0698:0015-021C SSO API> Retrieved global static cache memory for config LtpaToken.
08/09/2008 11:48:17.17 PM 0698:0015-021C SSO API> *** Retrieving Extra Token Info (SECTokenValidateAndGetTokenInfo2) ***
08/09/2008 11:48:17.17 PM 0698:0015-021C SSO API> ConfigName specified LtpaToken.
08/09/2008 11:48:17.17 PM 0698:0015-021C SSO API> Retrieved global static cache memory for config LtpaToken.
08/09/2008 11:48:17.17 PM 0698:0015-021C SSO API> Decoding Websphere style LTPA Single Sign-On token (LtpaToken).
08/09/2008 11:48:17.17 PM 0698:0015-021C SSO API> Dumping memory of encoded token 749 bytes.

08/09/2008 11:48:17.17 PM 0698:0015-021C SSO API> ERROR: when decoding LtpaToken Output Buffer Overflow.
08/09/2008 11:48:17.17 PM 0698:0015-021C SSO API> ERROR: unexpected error from called function Output Buffer Overflow.
08/09/2008 11:48:17.17 PM 0698:0015-021C SSO API> ERROR: examined token list did not contain any valid tokens matching the configuration.
08/09/2008 11:48:17.17 PM 0698:0015-021C SSO API> *** Freeing Single Sign-On Token List (SECTokenListFree) ***
08/09/2008 11:48:17.17 PM 0698:0015-021C SSO API> *** Freeing Single Sign-On Token (SECTokenFree) ***
08/09/2008 11:48:17.19 PM 0698:0015-021C SSO API> *** Validating Single Sign-On Token (SECTokenValidate) ***
08/09/2008 11:48:17.19 PM 0698:0015-021C SSO API> *** Retrieving Extra Token Info (SECTokenValidateAndGetTokenInfo) ***
08/09/2008 11:48:17.19 PM 0698:0015-021C SSO API> ConfigName specified LtpaToken.
08/09/2008 11:48:17.19 PM 0698:0015-021C SSO API> Retrieved global static cache memory for config LtpaToken.
08/09/2008 11:48:17.19 PM 0698:0015-021C SSO API> Decoding Websphere style LTPA Single Sign-On token (LtpaToken).
08/09/2008 11:48:17.19 PM 0698:0015-021C SSO API> Dumping memory of encoded token 749 bytes.

08/09/2008 11:48:17.20 PM 0698:0015-021C SSO API> Decrypt Websphere style Single Sign-On token (LTPA). Token length invalid <562>.
08/09/2008 11:48:17.20 PM 0698:0015-021C SSO API> ERROR: when decoding token Single Sign-On token is invalid.
08/09/2008 11:48:17 PM 28828641 DEBUG Thread-15 com.lotus.quickplace.util.QPServlet - *************** Request Header info ****************================
08/09/2008 11:48:17 PM 28828641 DEBUG Thread-15 com.lotus.quickplace.util.QPServlet - querystring=QPXML=%3Cservice%20action=%22query%22%3E%3Cquery%20type=%22get_member_places%22%3E%3Cmembers%3E%3Cperson%3E%3Cdn%3ECN=wpsadmin,OU=Consulting_Services,O=ourcompany%3C/dn%3E%3C/person%3E%3C/members%3E%3C/query%3E%3C/service%3E&dn=CN=wpsadmin,OU=Consulting_Services,O=ourcompany
08/09/2008 11:48:17 PM 28828641 DEBUG Thread-15 com.lotus.quickplace.util.QPServlet - Requested Method=GET
08/09/2008 11:48:17 PM 28828641 DEBUG Thread-15 com.lotus.quickplace.util.QPServlet - Remote address=http://10.2.15.10
08/09/2008 11:48:17 PM 28828641 DEBUG http://Thread-15] com.lotus.quickplace.util.QPServlet - Remote host=[
08/09/2008 11:48:17 PM 28828641 DEBUG Thread-15 com.lotus.quickplace.util.QPServlet - Request scheme=http
08/09/2008 11:48:17 PM 28828641 DEBUG Thread-15 com.lotus.quickplace.util.QPServlet - Request protocol=http://HTTP/1.1
08/09/2008 11:48:17 PM 28828641 DEBUG Thread-15 com.lotus.quickplace.util.QPServlet - Request remote user=Anonymous
08/09/2008 11:48:17 PM 28828641 DEBUG http://Thread-15] com.lotus.quickplace.util.QPServlet - Authorization scheme=[
08/09/2008 11:48:17 PM 28828641 DEBUG Thread-15 com.lotus.quickplace.util.QPServlet - USER-AGENT=http://Java/1.5.0
08/09/2008 11:48:17 PM 28828641 DEBUG Thread-15 com.lotus.quickplace.util.QPServlet - HOST=http://ebpl.ourcompany.com.au
08/09/2008 11:48:17 PM 28828641 DEBUG Thread-15 com.lotus.quickplace.util.QPServlet - CONTENT-TYPE=application/x-www-form-urlencoded
08/09/2008 11:48:17 PM 28828641 DEBUG Thread-15 com.lotus.quickplace.util.QPServlet - COOKIE=[LtpaToken==yTqt1igT/m1Y6DHaQFQ9Eqlnrj3XX2tFQ2rip5Bz74b8ZXxt39p70jdYbyzhmJs7K08HyJ/YHgFgsljWHojjGnYAwpMQ0ntCXx7bc4ol8FOE95Zuui5MsgJmQtoMc7zZ1IHmd9hhDAi/FpgxU1C/DMLr3nrO+ScD25mrExLUcDSGtTeb7/ZYP8mnOS81lWa4mvV7zhuApPTOXPKW2GKOUucSyemR5cPAbsa3u1OKApTq66UZqTusMDu+5IakfEwvCzu2jMUBzLSjUYni8Q01S2azjwYm4CLySnw6XQJ07JJCAmYqJ8/lXZ5v5fnck2NiyxCsPrMwt0vntJQZSbAb8Ja5Cxt2/M1Tl6BR8LJGn3hykwND9Dvxud41adiQbKXJ27wdTk7q
08/09/2008 11:48:17 PM 28828641 DEBUG Thread-15 com.lotus.quickplace.util.QPServlet - ACCEPT=http://text/html, image/gif, image/jpeg, *; q=.2, /; q=.2
08/09/2008 11:48:17 PM 28828641 DEBUG Thread-15 com.lotus.quickplace.util.QPServlet - CONNECTION=keep-alive
08/09/2008 11:48:17 PM 28828641 DEBUG Thread-15 com.lotus.quickplace.util.QPServlet - ******* Cookies ********
08/09/2008 11:48:17 PM 28828641 DEBUG Thread-15 com.lotus.quickplace.util.QPServlet - LtpaToken==yTqt1igT/m1Y6DHaQFQ9Eqlnrj3XX2tFQ2rip5Bz74b8ZXxt39p70jdYbyzhmJs7K08HyJ/YHgFgsljWHojjGnYAwpMQ0ntCXx7bc4ol8FOE95Zuui5MsgJmQtoMc7zZ1IHmd9hhDAi/FpgxU1C/DMLr3nrO+ScD25mrExLUcDSGtTeb7/ZYP8mnOS81lWa4mvV7zhuApPTOXPKW2GKOUucSyemR5cPAbsa3u1OKApTq66UZqTusMDu+5IakfEwvCzu2jMUBzLSjUYni8Q01S2azjwYm4CLySnw6XQJ07JJCAmYqJ8/lXZ5v5fnck2NiyxCsPrMwt0vntJQZSbAb8Ja5Cxt2/M1Tl6BR8LJGn3hykwND9Dvxud41adiQbKXJ27wdTk7qHF4dtaEY
08/09/2008 11:48:17 PM 28828641 DEBUG Thread-15 com.lotus.quickplace.util.QPServlet - *******Servlet parameters (Single Value style)********
08/09/2008 11:48:17 PM 28828641 DEBUG Thread-15 com.lotus.quickplace.util.QPServlet - dn=CN=wpsadmin,OU=Consulting_Services,O=ourcompany<END>
08/09/2008 11:48:17 PM 28828641 DEBUG Thread-15 com.lotus.quickplace.util.QPServlet - QPXML=<service action="query"><query type="get_member_places"><members><person><dn>CN=wpsadmin,OU=Consulting_Services,O=ourcompany</dn></person></members></query></service><END>
08/09/2008 11:48:17 PM 28828641 DEBUG Thread-15 com.lotus.quickplace.util.QPServlet - ***************** END Request Header info *************==================================
08/09/2008 11:48:17 PM 28828641 INFO Thread-15 com.lotus.quickplace.util.QPServlet - userAttrib = null
08/09/2008 11:48:17 PM 28828641 INFO Thread-15 com.lotus.quickplace.util.QPServlet - Session is null creating one...
08/09/2008 11:48:17 PM 28828641 INFO Thread-15 com.lotus.quickplace.util.QPServlet - calling getLtpaToken() = =yTqt1igT/m1Y6DHaQFQ9Eqlnrj3XX2tFQ2rip5Bz74b8ZXxt39p70jdYbyzhmJs7K08HyJ/YHgFgsljWHojjGnYAwpMQ0ntCXx7bc4ol8FOE95Zuui5MsgJmQtoMc7zZ1IHmd9hhDAi/FpgxU1C/DMLr3nrO+ScD25mrExLUcDSGtTeb7/ZYP8mnOS81lWa4mvV7zhuApPTOXPKW2GKOUucSyemR5cPAbsa3u1OKApTq66UZqTusMDu+5IakfEwvCzu2jMUBzLSjUYni8Q01S2azjwYm4CLySnw6XQJ07JJCAmYqJ8/lXZ5v5fnck2NiyxCsPrMwt0vntJQZSbAb8Ja5Cxt2/M1Tl6BR8LJGn3hykwND9Dvxud41adiQbKXJ2
08/09/2008 11:48:17 PM 28828657 INFO Thread-15 com.lotus.quickplace.util.QPServlet - calling getBasicAuth1()
08/09/2008 11:48:17 PM 28828657 INFO Thread-15 com.lotus.quickplace.util.QPServlet - calling getBasicAuth() headerValue = null
08/09/2008 11:48:17 PM 28828657 INFO Thread-15 com.lotus.quickplace.util.QPServlet - calling getBasicAuth2() return = isBasicAuth=false
08/09/2008 11:48:17 PM 28828657 INFO Thread-15 com.lotus.quickplace.util.QPServlet - create session using token...
08/09/2008 11:48:17 PM HTTP JVM: getNotesSession - NotesException - 4611 Single Sign-on Token is invalid
08/09/2008 11:48:17 PM HTTP JVM: Exception - invoking Action query action = 74.java.lang.NullPointerException
08/09/2008 11:48:17 PM 28828672 INFO Thread-15 com.lotus.quickplace.util.QPServlet - Printing stack trace
08/09/2008 11:48:17 PM HTTP JVM: java.lang.NullPointerException
08/09/2008 11:48:17 PM HTTP JVM: at com.lotus.quickplace.util.QPServlet.doPost(QPServlet.java:476)
08/09/2008 11:48:17 PM HTTP JVM: at com.lotus.quickplace.util.QPServlet.doGet(QPServlet.java:210)
08/09/2008 11:48:17 PM HTTP JVM: at javax.servlet.http.HttpServlet.service(HttpServlet.java:499)
08/09/2008 11:48:17 PM HTTP JVM: at javax.servlet.http.HttpServlet.service(HttpServlet.java:588)
08/09/2008 11:48:17 PM HTTP JVM: at lotus.domino.servlet.DominoServletInvoker.executeServlet(DominoServletInvoker.java:296)
08/09/2008 11:48:17 PM HTTP JVM: at lotus.domino.servlet.DominoServletInvoker.service(DominoServletInvoker.java:237)
08/09/2008 11:48:17 PM HTTP JVM: at lotus.domino.servlet.ServletManager.service(ServletManager.java:258)
08/09/2008 11:48:27.88 PM 0698:0016-04C4 HTTP Sessions> Looking for single sign-on session cookie in session cache (g9TZsviYR78hPNxqjapYrN6W7ucw7Fj4KLGcPJ1k0Sb7dQr2B6d/5wJUarxyCpYoST43hUEIZsunCDib80Tkx6lj3OXTa5eLwQQ5WwRL+b8WQdk8JZrMR0kVjKooHt7Q2brmytGD
08/09/2008 11:48:27.88 PM 0698:0016-04C4 HTTP Sessions> Single sign-on session cookie not found in cache, decoding. ORG=, CFG=LtpaToken
08/09/2008 11:48:27.88 PM 0698:0016-04C4 HTTP Sessions> Validating single sign-on session token list
08/09/2008 11:48:27.88 PM 0698:0016-04C4 SSO API> *** Validating Token List (SECTokenListValidateAndGetInfo) ***
08/09/2008 11:48:27.88 PM 0698:0016-04C4 SSO API> ConfigName specified LtpaToken.
08/09/2008 11:48:27.88 PM 0698:0016-04C4 SSO API> Retrieved global static cache memory for config LtpaToken.
08/09/2008 11:48:27.88 PM 0698:0016-04C4 SSO API> *** Retrieving Extra Token Info (SECTokenValidateAndGetTokenInfo2) ***
08/09/2008 11:48:27.88 PM 0698:0016-04C4 SSO API> ConfigName specified LtpaToken.
08/09/2008 11:48:27.88 PM 0698:0016-04C4 SSO API> Retrieved global static cache memory for config LtpaToken.
08/09/2008 11:48:27.88 PM 0698:0016-04C4 SSO API> Decoding Websphere style LTPA Single Sign-On token (LtpaToken).
08/09/2008 11:48:27.88 PM 0698:0016-04C4 SSO API> Dumping memory of encoded token 376 bytes.

08/09/2008 11:48:27.89 PM 0698:0016-04C4 SSO API> -Raw Token Username = CN=wpsadmin,OU=Consulting_Services,O=ourcompany
08/09/2008 11:48:27.89 PM 0698:0016-04C4 SSO API> -LDAP Realm = ebpl.ourcompany.com.au\:389
08/09/2008 11:48:27.89 PM 0698:0016-04C4 SSO API> -Username = CN=wpsadmin/OU=Consulting_Services/O=ourcompany
08/09/2008 11:48:27.89 PM 0698:0016-04C4 SSO API> -Raw Token Username = CN=wpsadmin,OU=Consulting_Services,O=ourcompany
08/09/2008 11:48:27.89 PM 0698:0016-04C4 SSO API> -Expiration Ticks = 1220888366666 09/09/2008 01:39:26 AM.
08/09/2008 11:48:27.89 PM 0698:0016-04C4 HTTP Sessions> Decoded single sign-on session cookie, logging in (CN=wpsadmin/OU=Consulting_Services/O=ourcompany)
08/09/2008 11:48:27.89 PM 0698:0016-04C4 SSO API> *** Freeing Single Sign-On Token List (SECTokenListFree) ***
08/09/2008 11:48:27.89 PM 0698:0016-04C4 SSO API> *** Freeing Single Sign-On Token (SECTokenFree) ***
08/09/2008 11:48:27.89 PM 0698:0016-04C4 HTTP Sessions> Looking for single sign-on session cookie in session cache

Hi,

Thank you! I made the change to WAS and restarted the Portal and the Places are now displaying in the My Places portlet and Sametime and Mail is also now working. There are now no errors in the logs and places are being returned without issues.

However, with the My Places portlet, only places of which the user is specified as a member is shown. We have created several public places but none of these show up in the portlet. I did think it might be because the My Places portlet only shows places of which you have a membership, but then that doesn't make sense as why is there a "public places" section then? The logs seem to show the same thing, there is no mention of any of the public places when it's collecting the Places.

Is there anything further that needs to be done to show public places in the My Places portlet?

Thank you again for your help.

Hi Charlie,

We're an IBM business partner and we are building this Portal for our own internal use, so at this stage we do not have a customer number to raise a PMR against, or else I probably would have done so already! If there's something that can be done to get the public places working, that would be great, as it's the last piece of our puzzle to before our new environment is fully set up.

Thanks heaps for all your help,
Jen

Charlie is right, the buffer overflow results because the new LTPAToken2 is longer than the previous LTPAToken.

Hi,

What urls are you using to access portal. I suspect that when you go back to portal you are using the url http://portal.domain.com/wps/portal -- that would cause the behavior you are seeing, /portal is for anonymous users and doesn't look for or try to use the LtpaToken. If you want sso to work to portal you have to use http://portal.domain.com/wps/myportal.

I think that will resolve your issue. If not, can you give me more details about the environment, what directory does Quickr authenticate with? What directory does portal authenticate with?

If that doesn't help, then could you enable the following debug: com.ibm.ws.security.*=all
sign into quickr, change the browser to the portal server/wps/myportal
and send me the trace.log to review.

thanks, hopefully it's just a matter of the url.
Charlie