Search code examples
javaopensso

OpenSSO 401 throws com.sun.identity.idsvcs.InvalidToken Service URL not found

Opensso server throws below exception intermittently when trying to validate a token at /opensso/identity/isTokenValid

Request: GET /opensso/identity/isTokenValid?tokenid=[generated token] HTTP/1.0

Response: 401 exception.name=com.sun.identity.idsvcs.InvalidToken Service URL not found

More information:

  1. Throws above exception only for certain tokens.
  2. Server has c66Encode=true as per https://java.net/projects/opensso/lists/users/archive/2009-11/message/339
Solution

  • This error is usually thrown when the cookie has genuinely invalid format, or the server/site ID embedded in the session ID is just incorrect.

    This usually happens when a session ID from a given OpenAM/SSO deployment is being presented to a different AM deployment (which has different server/site ID alignment). You should make sure that the session ID can't be used across the different environments, normally this is done by using different cookie domains or just by simply having different cookie names.