RSA SecurID Access O365 WS-Fed Authentication Fails Intermittently
3 years ago
Originally Published: 2019-04-26
Article Number
000046527
Applies To
RSA Product Set:  SecurID Access
RSA Product/Service: Cloud Authentication Service
Issue
When trying to access Office 365 seeing error:

Sorry but we're having trouble signing you in.
 
AADSTS20012: An error occurred when we tried to process a WS-Federation message.  The message was invalid.

 
Cause
When multiple Identity Routers (IDRs) are configured behind a load balancer, internal IDR traffic can get sent to the load balancer and then on to a different IDR. 

This loss of session persistence can cause authentication failure.
Workaround
Create static DNS entries to map the load balancer hostname to each IDR's proxy IP address:
  1. In the Cloud Admin Console go to Platform > Identity Routers.
  2. For each IDR:
    1. Edit and go to the Settings tab
    2. Create a static DNS entry specifying the IDR's proxy interface IP address and the load balancer's DNS hostname.  Reference Step 13 of Add an Identity Router Using the Cloud Administration Console.
  3. Publish the changes.
Notes
The load balancer DNS hostname should be defined in the Platform > Clusters > Edit > Load Balancer DNS Name field.

Related Articles

Trending Articles

Don't see what you're looking for?