Authentication failures in AEM 6.5 LTS with token.encapsulated and SAML user synchronization
This article explains how to resolve authentication failures in Adobe Experience Manager (AEM) 6.5 LTS Publisher instances that occur when using token encapsulation and SAML user synchronization.
Description description
Environment
Adobe Experience Manager (AEM) 6.5 LTS Publisher
Affected bundle versions:
- com.day.crx.sling.crx-auth-token: 2.7.1.V660-B0006
- com.adobe.granite.auth.saml: 1.0.59.V660-B0006
- cq-authhandler: 5.6.92.V660-B0006
- org.apache.sling.auth.core: 1.6.2
Issue/Symptoms
Authentication failures can occur during upgrade validation depending on the value of the token.encapsulated property in the com.day.crx.security.token.impl.impl.TokenAuthenticationHandler configuration:
- With
token.encapsulated=true, authentication fails due to legacy-format login tokens being rejected by the TokenReader, which expects a three-segment encapsulated token. - With
token.encapsulated=false, the token-format error is resolved, but authentication for inactive users or users requiring SAML synchronization fails during login token generation.
Both standard and SAML-based authentication may be affected, potentially blocking upgrade validation activities.
Cause
A regression in AEM 6.5 LTS Publisher’s token authentication logic causes incompatibility between legacy and encapsulated token formats and impacts SAML user synchronization when certain bundle versions are present.
Resolution resolution
Follow the steps below to resolve the issue.
- Check the value of the
token.encapsulatedproperty in thecom.day.crx.security.token.impl.impl.TokenAuthenticationHandlerconfiguration on your AEM 6.5 LTS Publisher instance. - If authentication fails with
token.encapsulated=truedue to legacy token format errors, settoken.encapsulated=falseto bypass the initial token parsing error. - If SAML user synchronization fails for inactive users or users requiring synchronization, verify that your environment is running the affected bundle versions listed above.
- Review the latest public AEM 6.5 LTS release notes and hotfix documentation to determine if a public hotfix is available for your bundle versions. If a public hotfix is available, apply it according to the official instructions.
- If no public hotfix is available, or if the issue persists after applying available updates, contact Adobe Support with your environment details and the observed symptoms for further assistance.
- After making changes, validate authentication for both standard and SAML-synchronized users to confirm the issue is resolved.