The following error may occur when either clicking on a SAS BI Dashboard indicator which contains a link to a SAS Stored Process or when using a graph indicator with a stored process url:

HTTP Status 403
Access to the specified resource () has been forbidden

Additionally, this error might be found in the application server log:

** UrlReplayBlockerFilter: SECURITY ACCESS VIOLATION **
The requested URL (/SASStoredProcess/do
can only be directly accessed from another SAS application, typically the SAS Information Delivery Portal.

This error is a result of a fix to the problem documented in SAS Note 20591 which is included in Hot Fix 913WEBINFRAKIT.

To avoid this error, you will need to uncomment a parameter in the web.xml file for the SASStoredProcess web application. This can be done by editing the following file:

\Web\Portal2.0.1\SASStoredProcess\WEB-INF\web.xml.orig

Please note: By following these steps, the security fix documented in SAS Note 20591 will be disabled.

The lessSecure parameter needs to be uncommented. The file should have a section like this:

<filter>
    <filter-name>UrlReplayBlocker</filter-name>
    <filter-class>com.sas.webapp.servlet.filters.UrlReplayBlockerFilter</filter-class>
    <!-- uncomment to allow bip session id pass through filter if there
     is no SessionContext map id parameter 'saspfs_sessionrequest'
    <init-param>
        <param-name>less-secure</param-name>
        <param-value>true</param-value>
    </init-param>
    -->
 </filter>

To uncomment the lessSecure param, remove the html comments around it, so that it looks like the following:

<filter>
    <filter-name>UrlReplayBlocker</filter-name>
    <filter-class>com.sas.webapp.servlet.filters.UrlReplayBlockerFilter</filter-class>
    <init-param>
       <param-name>less-secure</param-name>
       <param-value>true</param-value>
    </init-param>
</filter>

 

Operating System and Release Information