Users belonging to more than roughly 45 Active Directory groups (including groups carrying SID history) suddenly can't log into IFS via SSO — WebLogic logs show no login attempt at all for the affected user, even though connectivity and AD itself look fine. What's going on?

All FAQ questions / Security and access

Answer

This is very likely a request-size limit in WebLogic being exceeded — a user belonging to a large number of AD groups (especially with SID history) produces an unusually large security token/header, which can exceed WebLogic's default request-line or header-size limits and get silently rejected before it's even logged as a login attempt. Increase the 'Limit Request Field Size' and 'Limit Request Line' settings: on Apps10, this is configured directly in the IFS Middleware Server Admin Console; on Apps9, the equivalent change has to be made through the installer tool during a reconfiguration instead.

Documentation-based answer. Confirm the product and release before applying it. This answer has not been verified in an IFS environment.

← Browse Security and access questions