SSOEngine does not start and an error is received, "A referral was returned from the server." (148061)

Return

Feedback submitted.

Was this article helpful?

[Select Rating]

Title

SSOEngine does not start and an error is received, "A referral was returned from the server."
Description

The SSOWatch application (ssoengine.exe) does not start and in some circumstances the following error is received:

"A referral was returned from the server."

This issue started occurring on February 24, 2015.

Impacted versions

QESSO version 8.0.6 original and Service Pack (SP) 2

The following executables are affected: ssoengine.exe, SSOBuilder.exe, Console.exe, ESSOCredentialManager.exe, SSOFUS.exe, BIOFUS.exe

QESSO version 8.0.6 SP3, SP4 (HotFixes lower than .34), SP5 (HotFixes lower than .17)

The following executables are affected: SSOBuilder.exe, Console.exe, ESSOCredentialManager.exe, SSOFUS.exe, BIOFUS.exe

Not affected: ssoengine.exe

Depending on your configuration and if you are running 8.0.6 SP3 and above, end users may not be impacted.

Version 8.0.5 and below do not have the problem because executables are not signed.

Windows XP is not impacted.
Cause

The certificate used to digitally sign the ssoengine.exe expired on 23/2/2015. If User Account Control (UAC) is enabled on the system Windows will block the execution of SSOWatch.
Resolution

PLEASE NOTE: This issue has been addressed in the latest build of Enterprise Single Sign-On, version 8.0.6 SP6, which can be downloaded here: Enterprise Single Sign-On - Download New Releases.

WORKAROUND

1. For version 8.0.3 SP3 and above:

In these versions ssoengine.exe is not affected but SSO may not start if it is launched by the CredentialManager. A workaround to the problem on workstations is to apply the following configuration in the registry:

[HKEY_LOCAL_MACHINE\SOFTWARE\ Enatel\WiseGuard\AdvancedLogin]
StartSSOEngine: dword:00000001

2. For all other versions and for a global workaround including the ESSO console and Enterprise Studio, the workaround is to disable Windows UAC. This can be done through the control panel, via the registry or via Group Policy.

To turn off UAC in Control Panel:

- Open Control Panel and select "User Accounts".

- Select "Change User Account Control settings":

- Set the control to "Never notify" then click OK. This will require a restart of the system.

Windows 7:

Windows Server 2008:

To turn off UAC in the registry:

- Change following value from 1 to 0:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
EnableLUA=dword:00000000
Note: To be effective a restart of the system is required.

To turn off UAC using Group Policy:

1. Run Group Policy Management Console for AD-based domain GPO editor. Browse to the required GPO which is linked to the domain or OU where the policy wants to apply.

2. Navigate to the following tree branch:

Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options

3. Locate the following policy in the right pane:

User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode

Set its value to "Elevate without prompt".

4. Locate the following policy in the right pane:

User Account Control: Detect application installations and prompt for elevation

Set its value to Disabled.

5. Locate the following policy in the right pane:

User Account Control: Run all administrators in Admin Approval Mode

Set its value to Disabled.

6. Locate the following policy in the right pane:

User Account Control: Only elevate UIAccess applications that are installed in secure locations

Set its value to Disabled.

7. Systems must be restarted for the change to take effect.

STATUS

This issue has been addressed in the latest build of Enterprise Single Sign-On, version 8.0.6 SP6, which can be downloaded here: Enterprise Single Sign-On - Download New Releases
Change Request

52923
Additional Information

One Identity does not provide support for problems that arise from improper modification of the registry. The Windows registry contains information critical to your computer and applications. Make sure you back up the registry before modifying it. For more information on the Windows Registry Editor and how to back up and restore it, refer to Microsoft Article ID 256986 “Description of the Microsoft Windows registry” at Microsoft Support.