CosmosReact WebPortal does not load from LDAP (custom - SSO)

Hi all,

I am experimenting Pega Cosmos building a new Application.
I created the application and developed a new case.
From business it’s required that the new Application must be accessible only by LDAP (Custom Authentication Activity, so no LDAP pure is defined).

I defined and added the WebLDAP authentication service on the App and I successfully logged in to Dev Studio.

Now, I am wondering to Log in to Web Portal directly.
So I configured an Access Group which links to the new Application and it has the WebPortal (defined as default) as Available portals.
When I try to login the browser shows me a blank page. If I consult the console dev (chrome one) I can see an error:

Refused to load the script ‘https://c11n-prod-eu-south-1.constellation.cloud.pega.net/c11n/8.7.6-1181/pega-bootstrap-component.js’ because it violates the following Content Security Policy directive: “script-src ‘unsafe-inline’ ‘unsafe-eval’ ‘self’ http://www.google-analytics.com https://ssl.google-analytics.com https://unpkg.com/swagger-ui-dist@3/swagger-ui-bundle.js”. Note that ‘script-src-elem’ was not explicitly set, so ‘script-src’ is used as a fallback.

The stranger things is that if I refresh the page then it works.

I am using a URL composed by query param so I have the URL composed such:

myapp.pegacloud.net/prweb/WebLDAP1/app/ApplicationA/STANDARD?Param1=value1&Param2=value2

Instead, when I refresh the page the url become:

myapp.pegacloud.net/prweb/WebLDAP1/app/ApplicationA

and then it works.

If I do not use WebLDAP with an operator defined with the AG that links to the WebPortal directly it works.

Does anyone can help me?

Best,

Vincenzo

@VincenzoF17002386 - Here the issue is with Content security policy(CSP) which is defined in application definition rule in Security tab.

Thank you.

@Priyanka Boga Hello Priyanka, thanks for you reply.

I edit this answer cause thanks to your answer I found the solution. I had to set the allowed weblist.
I defined a new CSP with this websites.

Kind regards,

Vincenzo