Support Article

SSO Login: IE11 Kerberos token exceeds Tomcat maxHeaderSize

SA-16583

Summary



When IE11 users access Pega through the Single-Sign-On URL they experience intermittent HTTP 400 error. FireFox users do not experience any issues.


Error Messages



HTTP 400


Steps to Reproduce



Configure Tomcat 7.0.59 for Kerberos authentication using the SPNEGO Realm.
 

Root Cause



IE11 is sending in the full Kerberos token which ends up being large and exceeds the default Tomcat maxHttpHeaderSize of 8192 (8KB).  

Note: The default value in Tomcat 6 for
maxHttpHeaderSize is 4096.

Resolution



Make the following change to the operating environment: 

Increase the maxHttpHeaderSize in the Tomcat HTTP connector settings.

Published January 31, 2016 - Updated October 8, 2020

Have a question? Get answers now.

Visit the Collaboration Center to ask questions, engage in discussions, share ideas, and help others.