Return
-
Title
Error: "Communication with Starling Two-Factor Authentication failed. Reason: An error occurred: An error occurred while sending the request. (60462) " -
Description
When attempting to set a user up for Starling authentication the error "Communication with Starling Two-Factor Authentication failed. Reason: An error occurred: An error occurred while sending the request. (60462) " is shown
Or
In Settings | Secondary Authentication when trying to add "Starling Two-Factor Authentication" clicking OK errors with"An error occured while testing the configuration settings for this provider, 'Providername'. Please review each setting value and try again. (60515)."Or
When attempting to logon with an existing Starling user, the error "A system error occurred and has been logged. Please try again later or contact your administrator." is shown when logging in.
-
Cause
Safeguard communicates to Starling Two-Factor Authentication using HTTPS endpoints.
Firewalls must allow outbound traffic from all cluster members (Primary and Replica appliances) to the HTTPS endpoints, and the return traffic. As the IP addresses can change over time, you should not lock down the firewall to the individual IP addresses. -
Resolution
1/ If using Safeguard 2.10 and below ensure the latest Starling CA certificates are installed:
https://support.oneidentity.com/one-identity-safeguard-for-privileged-passwords/kb/311790
2/ Ensure the DNS servers setup on the X0 interface can resolve external addresses. This can be validated by performing a nslookup on against the Starling endpoints sts.cloud.oneidentity.com and 2faclient.cloud.oneidentity.com from Settings | Diagnostics | NS Lookup.
As of March 2021:
sts.cloud.oneidentity.com resolves to 13.91.196.112
2faclient.cloud.oneidentity.com resolves to 104.42.152.64
Note: As the IP addresses above can change over time, you should not lock down the firewall to the individual IP addresses.
3/ Ensure that all Safeguard cluster members on the X0 interfaces can communicate to sts.cloud.oneidentity.com and 2faclient.cloud.oneidentity.com via HTTPS TCP/443. A telnet test can be used to validate this. From Settings | Appliance | Network Diagnostics | Telnet:
4) Ensure the HTTPS traffic is not being intercepted by a man in the middle (MIMT) HTTPS transparent proxy such as a Sophos UTM, or Fortinet.NOTE: When unjoining Safeguard from Starling the end point accountsupervisor.cloud.oneidentity.com is also required.