Intermittent Login Popup When Opening Cases in a Constellation Application

User Experience
1

We recently moved a Constellation‑based application to Prod and have started noticing an intermittent issue when users attempt to open a case.

In some instances, clicking the case link triggers an unexpected Pega login popup, but selecting “Login” does not progress further and the case fails to open. Interestingly, pressing Tab followed by Enter allows the case to open successfully, though the behavior is sporadic and not consistent across all users.

A similar issue had been observed in lower environments but seemed to resolve itself over time. I have verified the relevant Constellation DSS settings and they appear correctly configured.

During troubleshooting, I also found the following error in the logs: “Access token validation failed” with HTTP Status Code 401 under the OAuth 2.0 category for PegaRULES.

Has anyone else encountered this combination of unexpected login popup and OAuth 2.0 access token validation failure?

Any guidance on which logs or configurations to check, or whether this is a known issue, would be greatly appreciated.

image
image388×189 5.98 KB

2

I would prefer to check the following items to ensure the timeout is configured correctly.

  1. Access Group → Advance tab → Authentication Timeout
  2. OAuth Configuration → Token expiry timeouts
3

Hi Ramesh

1). Auth time out is empty

2). Token Expiry - 3600s (compared lower environments and higher)

4

Could you please confirm the reasonable timeout for Authentication Timeout?

how about Refresh token?

5

But it has been the same for a while in Test and prod environments . Let me have a look on this part

6

@Tharun_K_T i think we had the same issue ealier this year when using Constellation.

You can try it and let us know

===

To fix this error:

image
image1099×266 34.7 KB

Change to the highlighted settings below in OAuth 2.0 client registration rule.

image
image680×778 74 KB

7

Hi Will, Thanks for the info. Let me try this and keep you informed

8

@Will_Cho I have 2 OAuth profiles one for the traditional app and the other for the constellation application. Adding the above mentioned only in constellation helps?

image

9

@Tharun_K_T For us, the OAuth 2.0 Client Registration rule was auto generated by the system when we imported a BluePrint file to build the application. I just updated the existing rule.

10

Similarly, The OAuth was auto generated for us by system

11

Did this solve the problem? @Tharun_K_T
We are also facing the same issue.

12

Hey @NaganandShenoy Since the issue is sporadic, I’m implementing the fix in the lower environment first to observe its behavior, Keeping you posted

13

@NaganandShenoy @Tharun_K_T this was the Pega support ticket that we raised to get the solution above for our client: INC-D4790

In case you need to raise an INC, I suggest referring it.

From the resolution comment in the ticket:

The issue was resolved by updating the OAuth2 client registration rule instance by following one of the following steps:

  1. Set Token issuance to Issue a new refresh token and reset expiry
  2. Disable Set refresh token expiry from IDP session expiry - When this is enabled (by default), the system ignores the value set for Refresh token lifetime (in seconds) in the Token expiry section and gets the value from the IDP. There can be use cases where IDP is not sharing refresh token during authentication phase or SSO might have not been implemented and the defaulted timeout is too short.

This is discussed in the following article: Active user gets logged out of Constellation application | Support Center

14

@Will_Cho Thanks for the info, I could see this config was missed in prod, i have implemented. I will monitor a time. If it still persists will for a Pega Support ticket