Banne 9 Admin Pages" "Service Invocation Failed. Couldn't access remote service"

[Miles, Ryan]

> I'm wondering if anyone who uses Banner 9 with CAS has run into this issue.
> We tried enabling HTML Local Storage with client-side sessions in
> Shibboleth but once we did that, users received the following error when
> accessing Admin Pages:

> Service Invocation Failed
> Couldn't access remote service

We are a Banner school and recently ran into the same issue. Banner 9 AppNavigator / Admin pages is actually two apps in one. AppNavigator is the menu system and Admin pages / forms loads inside an iframe within AppNavigator, each authenticate seperatly; horrible architecture by Ellucian. Because of this, you have to tell Shibboleth IdP to allow it to load within an iframe. We have our idp.properties set to "idp.frameoptions=" and  "idp.csp=" then have our web application firewall (WAAP) block iframes except for specific apps, Banner AppNavigator being one of them.

I hope that helps, 

-Ryan


>> I'm wondering if anyone who uses Banner 9 with CAS has run into this issue. We
>> tried enabling HTML Local Storage with client-side sessions in Shibboleth but
>> once we did that, users received the following error when accessing Admin
>> Pages:

>The CAS support has limitations around use of client-side sessions in the IdP when proxy tickets are used, partially addressed in 4.1. Otherwise there is literally no possible interaction here with the IdP's session layer.

>-- Scott


> I'm wondering if anyone who uses Banner 9 with CAS has run into this issue.
> We tried enabling HTML Local Storage with client-side sessions in
> Shibboleth but once we did that, users received the following error when
> accessing Admin Pages:

> Service Invocation Failed
> Couldn't access remote service

> A number of schools have help articles about this, but they all simply say
> to clear the browser's cache. Unfortunately, that doesn't resolve the issue
> for us.

> One of our Banner admins found an article from Ellucian (000049779) stating
> that this is a SameSite cookie issue. It explains how to set SameSite=None
> on the Banner Admin server, but we still have the issue.

> Has anyone run into this and figured out a workaround?

> Thanks,
> Jason