PROBLEM
User-Agent Client Hints (UA-CH) rollout for Chrome 85+ is causing authentication failures with the OnBase IdP.
ERROR MESSAGE
CAUSE
Google is rolling out User-Agent Client Hints (UA-CH) changes in Chrome 85. The change adds two new request headers that are sent by default: `sec-ch-ua` and `sec-ch-ua-mobile` which cause authentication issues with the OnBase IdP. For additional information, we recommend reviewing the following:
While other browsers have not yet released this implementation, we do anticipate them doing so in the future.
AFFECTED VERSIONS
OnBase v17 and v18 using the OnBase IdP to authenticate from the OnBase Web Client.
ANALYSIS
After further analysis, it was determined this issue resides in how ASP.Net Web Form based applications escaped certain characters in the request header. This produced a failure when attempting to be processed by the OnBase IdP (Identity Provider).
SOLUTION
This issue is already resolved in OnBase version 18.0.1.89 and higher of the OnBase Web Server. It is recommended systems currently running OnBase version 18 (prior to version 18.0.1.88) update to the latest version for complete remediation.
WORKAROUND/S
The following workarounds are available for environments unable to upgrade to the complete solution in the latest release of OnBase version 18. Please note these are recommended to be temporary solutions until an upgrade can be completed.
- Users can manually go in to the Chrome browser setting and disable the flag. For instructions, please visit https://www.chromium.org/updates/ua-ch.
- Administrators can push out a version of chrome with this setting disabled
- Apply URL Rewrite rule to the Web Server/AppNet for affected environments. For instructions, please visit https://community.hyland.com/blog/posts/76612-url-rewrite-workaround-for-browser-user-agent-client-h...
13 Comments
