Return
-
Title
SSOEngine does not start and an error is received, "A referral was returned from the server." -
Description
The SSOWatch application (ssoengine.exe) does not start and in some circumstances the following error is received:
"A referral was returned from the server."
This issue started occurring on February 24, 2015.
Impacted versions
QESSO version 8.0.6 original and Service Pack (SP) 2
The following executables are affected: ssoengine.exe, SSOBuilder.exe, Console.exe, ESSOCredentialManager.exe, SSOFUS.exe, BIOFUS.exe
QESSO version 8.0.6 SP3, SP4 (HotFixes lower than .34), SP5 (HotFixes lower than .17)
The following executables are affected: SSOBuilder.exe, Console.exe, ESSOCredentialManager.exe, SSOFUS.exe, BIOFUS.exe
Not affected: ssoengine.exeDepending on your configuration and if you are running 8.0.6 SP3 and above, end users may not be impacted.
Version 8.0.5 and below do not have the problem because executables are not signed.
Windows XP is not impacted. -
Cause
The certificate used to digitally sign the ssoengine.exe expired on 23/2/2015. If User Account Control (UAC) is enabled on the system Windows will block the execution of SSOWatch. -
Resolution
PLEASE NOTE: This issue has been addressed in the latest build of Enterprise Single Sign-On, version 8.0.6 SP6, which can be downloaded here: Enterprise Single Sign-On - Download New Releases.
WORKAROUND
1. For version 8.0.3 SP3 and above:
In these versions ssoengine.exe is not affected but SSO may not start if it is launched by the CredentialManager. A workaround to the problem on workstations is to apply the following configuration in the registry:
[HKEY_LOCAL_MACHINE\SOFTWARE\ Enatel\WiseGuard\AdvancedLogin]StartSSOEngine: dword:00000001
2. For all other versions and for a global workaround including the ESSO console and Enterprise Studio, the workaround is to disable Windows UAC. This can be done through the control panel, via the registry or via Group Policy.
To turn off UAC in Control Panel:
- Open Control Panel and select "User Accounts".
- Select "Change User Account Control settings":
- Set the control to "Never notify" then click OK. This will require a restart of the system.
Windows 7:
Windows Server 2008:
To turn off UAC in the registry:
- Change following value from 1 to 0:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
EnableLUA=dword:00000000Note: To be effective a restart of the system is required.
To turn off UAC using Group Policy:
1. Run Group Policy Management Console for AD-based domain GPO editor. Browse to the required GPO which is linked to the domain or OU where the policy wants to apply.
2. Navigate to the following tree branch:
Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options
3. Locate the following policy in the right pane:
User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode
Set its value to "Elevate without prompt".
4. Locate the following policy in the right pane:
User Account Control: Detect application installations and prompt for elevation
Set its value to Disabled.
5. Locate the following policy in the right pane:
User Account Control: Run all administrators in Admin Approval Mode
Set its value to Disabled.
6. Locate the following policy in the right pane:
User Account Control: Only elevate UIAccess applications that are installed in secure locations
Set its value to Disabled.
7. Systems must be restarted for the change to take effect.
STATUS
This issue has been addressed in the latest build of Enterprise Single Sign-On, version 8.0.6 SP6, which can be downloaded here: Enterprise Single Sign-On - Download New Releases -
Change Request
52923 -
Additional Information
One Identity does not provide support for problems that arise from improper modification of the registry. The Windows registry contains information critical to your computer and applications. Make sure you back up the registry before modifying it. For more information on the Windows Registry Editor and how to back up and restore it, refer to Microsoft Article ID 256986 “Description of the Microsoft Windows registry” at Microsoft Support.