401 error and infinite loop when loading CMS URL after ExternalAuthentication SSO using SiteMinder - Support and Troubleshooting

401 error and infinite loop when loading CMS URL after ExternalAuthentication SSO using SiteMinder Description  401 error and infinite loop when loading CMS URL after ExternalAuthentication SSO using SiteMinder

Problem There is a 401 error and infinite looping when loading a CMS site after ExternalAuthentication SSO using SiteMinder.

Symptoms Launching a CMS site URL (for example, https:// .service-now.com/ess) when the instance is integrated with SSO using SiteMinder can cause an infinite loop and 401 unauthorized errors within the Chrome Developer Tool Console:

Cause This issue only occurs when SAML (glide.authenticate.external) is enabled and the specific configuration below is in place:

System property glide.authenticate.failed_requirement_redirect is set to the instance URL: For example: https:// .service-now.com Product documentation reference: https://docs.servicenow.com/csh?topicname=r_ForcingLoginViaSSOOnly.html&version=latest

The view_content Public Pages [sys_public] record is set to false . This makes CMS private and not available to "guest" requiring authentication and login. Product documentation reference: https://docs.servicenow.com/ For the above scenario, the glide.authenticate.failed_requirement_redirect property needs to be set to a static page; otherwise, it goes into the authentication loop.

Warning : The glide.authenticate.failed_requirement_redirect property should be set to the URL of the IdP login page or a company portal page outside of ServiceNow.

Resolution This issue can be resolved using these steps:

Set view_content to true . Set glide.authenticate.failed_requirement_redirect to the URL of the IdP login page. Another possible solution is to use this configuration:

Set the glide.authenticate.failed_requirement_redirect system property to the URL of the IdP login page or a company portal page outside of ServiceNow. Add the glide.ui.rotate_sessions system property. Product documentation reference: https://docs.servicenow.com/csh?topicname=c_HighSecuritySettings.html&version=latest Rotate HTTP session identifiers to reduce security vulnerabilities. See: https://www.owasp.org/index.php/Session_Management#Rotate_Session_Identifiers Set Default: Yes Note: If you are using the SAML 2.0 plugin for single sign-on authentication, set this feature to false . Otherwise, it interferes with the session information sharing that takes place between ServiceNow and the identity provider.