"Resource is not available" message after MFA authorization policy.

eddpot 3 months ago

Hi,

I have recently attempted to set up an Authorization Policy for a proxy service in Access Manager to force users to reauthenticate with netIQ MFA if they are connecting to the proxy service from an IP address external to the organisation. I have a basic username/password authentication procedure set up on the route, and the step up rule on the Authorization section.

The flow works as expected, with users on an external IP address being asked to pass MFA after providing their username and password. However, once the user passes MFA the user is presented an Access Manager page reporting "Resource is not available"

Users connecting internally pass the basic authentication contract and gain access to the resource as expected.

Does anyone have any thoughts on why this might be happening? I can provide any further details people might need.

Thanks

Tags:

access manager

advanced authentication

Top Replies

Sebastijan Sef 3 months ago in reply to eddpot +1

Hi! Important thing regarding this article is that error happens when Access Gateway ESP tries to update existing session with internal CookieBroker. That happens when user is first authenticated…

0 eddpot 3 months ago

Just been retesting this and the error message reported appears to have changed to "Unable to authenticate" (409-esp-xxxxx...)
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Sebastijan Sef 3 months ago in reply to eddpot

Have you maybe checked this article:

https://portal.microfocus.com/s/article/KM000012670?language=en_US

Kind regards,

Sebastijan
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 eddpot 3 months ago in reply to Sebastijan Sef

Thanks for your comment Sebastijan.

I did consider this article previously. My situation doesn't quite match as it's a single protected resource, but I suspect it's still worth following the resolution 'please contact support'
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Sebastijan Sef 3 months ago in reply to eddpot

Hi!

Important thing regarding this article is that error happens when Access Gateway ESP tries to update existing session with internal CookieBroker.

That happens when user is first authenticated with one contract and then AGW requires different/higher authentication for whatever reason.

Simplest way to find out if this is your case is to increase apache logs (as described at the end of KB article) and look for calls to http://127.0.0.1:8181/ in log files. You should see http/409 error reported.

Please also note that this bug was introduced in AM version 5.0.3, so if you are using previous version this is not the case (as far as I know).

Kind regards,

Sebastijan
Cancel
Vote Up +1 Vote Down

Sign in to reply

Verify Answer

Cancel
0 eddpot 2 months ago in reply to Sebastijan Sef

Apologies, it took some time for me to follow this up. I've followed the steps but the /var/log/novell-apache2/error_log doesn't report any :409 errors so I suspect my issue is not related to this error
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Menu

NetIQ Advanced Authentication

"Resource is not available" message after MFA authorization policy.

Tags:

Top Replies

Resources