Forum Discussion
APM/OAuth2 : auto apply changes made by discovery
- Nov 20, 2024
Hi Lucas,
Small update on the case. Engineering has been able to solve Issue with an engineering hotfix for 17.1.1.4
ID1293805-1: Access policies not in Partition Common are not applied in auto discovery process
Since then the issue has been fixed !
Thanks again for your help at the beginning of this case!
Regards,
Olivier
So, there has been a change in the JWT this week-end on Azure Entra, and I got a lot of logs from restjavad.
I won't post the part where it discovers the new JWTs, delete the old jwt/certs in the config, create the new one, and skip to the SAVE_AND_APPLY phase of OIDCDiscoverTask. (I also stripped the begining of the lines for readability)
All lines start with [F][21133][25 Aug 2024 18:25:27 UTC][8100/tm/access/oidc/discover OIDCDiscoverTaskCollectionWorker]
[18:25:26] install meta data sending mcp request
[18:25:26] intall meta dataa sending mcp request
[18:25:27] OIDC Discover provider name is /HES-SO/HES_AGF_AzAD_Provider and step SAVE_AND_APPLY
[18:25:27] saveAndApply :mcpProviderName /HES-SO/HES_AGF_AzAD_Provider
[18:25:27] applyPolicyForProvider chain >>
[18:25:27] applyPolicyForProvider chain >>
[18:25:27] applyPolicyForProvider total items in chains = 2
[18:25:27] setup doChainQuery queries : chain >>
[18:25:27] do chain query with names [/HES-SO/HES_AGF_AzAD_Provider], remaining step 5
[18:25:27] setup mcp queryAll for name /HES-SO/HES_AGF_AzAD_Provider qi =
[18:25:27] setup doChainQuery queries : chain >>
[18:25:27] do chain query with names [/HES-SO/HES_AGF_AzAD_Provider], remaining step 5
[18:25:27] setup mcp queryAll for name /HES-SO/HES_AGF_AzAD_Provider qi =
[18:25:27] mcpOperation queryInfo=
[18:25:27] results from mcp-multi requests /HES-SO/HES_AGF_M365_JWTP, for queryInfo =
[18:25:27] do chain query with names [/HES-SO/HES_AGF_M365_JWTP], remaining step 4
[18:25:27] setup mcp queryAll for name /HES-SO/HES_AGF_M365_JWTP qi =
[18:25:28] mcpOperation queryInfo=
[18:25:28] results from mcp-multi requests /HES-SO/HES_AGF_OAuth_Srv, for queryInfo =
[18:25:28] do chain query with names [/HES-SO/HES_AGF_OAuth_Srv], remaining step 4
[18:25:28] setup mcp queryAll for name /HES-SO/HES_AGF_OAuth_Srv qi =
[18:25:28] mcpOperation queryInfo=
[18:25:28] results from mcp-multi requests for queryInfo =
[18:25:28] applyPolicyForProvider handling of a chain
[18:25:28] mcpOperation queryInfo=
[18:25:28] results from mcp-multi requests /HES-SO/HES_AGF_M365_act_oauth_client_ag, for queryInfo =
[18:25:28] do chain query with names [/HES-SO/HES_AGF_M365_act_oauth_client_ag], remaining step 3
[18:25:28] setup mcp queryAll for name /HES-SO/HES_AGF_M365_act_oauth_client_ag qi =
[18:25:28] mcpOperation queryInfo=
[18:25:28] results from mcp-multi requests /HES-SO/HES_AGF_M365_act_oauth_client, for queryInfo =
[18:25:28] do chain query with names [/HES-SO/HES_AGF_M365_act_oauth_client], remaining step 2
[18:25:28] setup mcp queryAll for name /HES-SO/HES_AGF_M365_act_oauth_client qi =
[18:25:28] mcpOperation queryInfo=
[18:25:28] policyName = /HES-SO/HES_AGF_M365, resolvedPolicyName = null
[18:25:28] results from mcp-multi requests null, for queryInfo =
[18:25:28] applyPolicyForProvider handling of a chain
[18:25:28] aps is empty.
[18:25:28] OIDC Discover provider name is /HES-SO/HES_AGF_AzAD_Provider and step SLEEP_AND_RUN_AGAIN
[18:25:28] Task ID 3394e5d4-9c7d-4685-808d-738c16e11dc8 for provider /HES-SO/HES_AGF_AzAD_Provider has completed one round, we will schedule the next discover after 1440 minutes
Lines 36-39 looks odd.
and sill no trace of "generation-action increment" in audit log.
lifex35103@vmmod.comlifex35103@vmmod.com
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com