403 error after upgrading to 16.2

jaredw over 7 years ago

I created a Site in Appian 16.1. Today I upgraded the server to Appian 16.2. Every time i try to log in to the site I get a 403 Sorry, your request cannot be processed. I also noticed that in the URL it loses the site link IE the login is "/suite/sites/phs-users" and with the 403 error the link is "/suite/sites".

The corresponding error shows up in the server.log file:

ERROR com.appiancorp.security.authz.Forbidden - Could not log forbidden URI. forbiddenUri=/portal/portal.jsp, originalUri=/

Things I have tried to do to resolve this issue:

1. Stopped JBoss
2. Deleted:
<JBoss home>/standalone/tmp
<JBoss home>/standalone/data
3. Restarted JBoss
4. Cleared the cache on my computer before trying again.
5. The error still occurred

Then I did the following:
Compare the Standalone.xml files of 16.1 to 16.2, and they are Identical. Compared the web.xml files of 16.1 to 16.2 and there was nothing in them mentioning portal.jsp.

I tried going into the si...

server.log

Discussion posts and replies are publicly visible

0 jaredw over 7 years ago

...te and making a small change and saving it. I then logged out and tried to log into the site directly again and had the error happen again.

If I'm already logged on to Appian and go to the site it loads perfectly fine.

Has anyone else run into this issue? I attached the server.log file as well. There may be other errors in it since I just did the installation today but the one I need assistance with for this issue is the ERROR com.appiancorp.security.authz.Forbidden - Could not log forbidden URI. forbiddenUri=/portal/portal.jsp, originalUri=/

Thank you in advance.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Tom Ryan
Appian Employee
over 7 years ago

Do you have any SSO or custom authentication configured in this environment? If so is it configured through the admin console or through spring xmls?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 jaredw over 7 years ago

We have security configured through the spring xml. If the security configuration was what is causing the issue then why is it only an issue with 16.2? I compared the spring security files (spring-security-03-auth-mgr.xml) between 16.1 and 16.2 and there was only one difference which wasn't even being used within our spring-security-03-auth-mgr-override.xml
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 jaredw over 7 years ago

I just did a test on this today. The 403 error when signing into a site only occurs when using Internet Explorer. I'm on IE 11 when doing this test. The 403 error does NOT occur when I log into the site through Google Chrome.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Tom Ryan
Appian Employee
over 7 years ago

FIrstly I would suggest migrating your security configs to the Admin console if at all possible:

forum.appian.com/.../Migrating_LDAP_Configuration_to_Administration_Console.html
forum.appian.com/.../Migrating_SAML_Configuration_to_the_Admin_Console.html

If not, since it is working in Chrome it suggests something in the request that IE isn't handling correctly. Can you do a network capture (either using the IE developer tools or an external tool like Fiddler) while reproducing the issue, and let us know the results.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 jaredw over 7 years ago

I set up the LDAP security in the admin console and removed the spring security override. i tested the logins to make sure the users that could log in still can. the issue still happened in IE.

Attached is the network capture exported from IE developer tools.
NetworkData.xml
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Tom Ryan
Appian Employee
over 7 years ago

It seems that your IE is not correctly re-directing to the site page after you have logged in. After logging in, there should be a request for "/suite/sites/phs-users", but instead it is just for "/suite/sites". In this case the 403 is expected. Since it is working in other browsers, it seems that the settings in your IE are preventing this working correctly. Check the following and see if it resolves the issue:

yourbusiness.azcentral.com/enable-automatic-redirect-internet-explorer-14672.html
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 jaredw over 7 years ago

both items that it says to enable are already enabled. is there some setting in one of the config files that could be missing or wrong?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Tom Ryan
Appian Employee
over 7 years ago

Can you zip and attach your <Appian Home>/ear/suite.ear/web.war/WEB-INF/conf/security directory.
Can you also ensure that you are not using compatibility mode in IE.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Mike James
Certified Lead Developer
over 7 years ago

Having exactly the same issue (403 on sites URL using IE 11) - was there any resolution to this?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel