Login Denied:Failed to validate sso token

Hi,

Recently in my OMMConsumer application (EMA C++ (ema3.7.3.L1)) in pre-production received following 'Status Message' from RTO

}FtGroupId [100] SessionId [1] IsActiveSession [TRUE]{Output: Timestamp: 20251028-07:31:31.957967 StatusMsg
streamId="1"
domain="Login Domain"
state="Closed / Suspect / Internal error from sender / 'Login Denied:Failed to validate sso token'"
name="AQIC5wM2LY4SfczNcJMlLDrL2EYj5mB359SY0OIdh1Y9TpI%3D%40AAJTSQACMTAAAlNLABM4MTYxNTg5NTgxNTk0NDI3MjgwAAJTMQACMjU%3D%23"
nameType="1"
StatusMsgEnd
}

I have following question.

In a situation like this, should i attempt to reconnect automatically from my OMMConsumer application, or would you recommend manual intervention to re-connect? Asking this because, according to https://statics.teams.cdn.office.net/evergreen-assets/safelinks/2/atp-safelinks.html, this can occur due to an outage at refintive side.

If automatic reconnection with a fallback mechanism is recommended, which state should i look for to take that decision? "Stream State - Closed" is enough or should i consider Data state as well ?

Find more posts tagged with

c++

rrto

ema-api

#technology

Accepted answers

umer.nalla

Hope "Login Denied:Failed to validate sso token" issue is not related to same credentials being shared between multiple environments?

As my colleague explained, the issue is related to the single Machine-ID being used in mutiple applications/instances.

As suggested, you can request multiple Machine-IDs - OR the other alternative (better for the long term) is to get your V1 Machine-ID converted to an V2 Service Account/Service ID. With the Service ID, you can use the same one in multiple applications (upto 5 I believe).

All comments

wasin.w V3

Hello @ThilinaI

Thank you for reaching out. According to the given status message, the Login stream got status message with "Closed Suspect" state. It means the connection and all subscriptions are already closed and that OMMConsumer object cannot be used anymore.

An application can reconnect to RTO by creating a new OMMConsumer object and re-subscribe items.

By the way, how often you got this "Login Denied:Failed to validate sso token" error status? Do you have other applications that use the same RTO credential running on the same time?

ThilinaI

Hi @wasin.w V3 thanks for the reply.

I'll get back on whether we are using same credentials in some other environments.

For my earlier question, does that mean, if I get Closed/Suspect in the 'Status Message' for Login Domain,

I should destroy OMMConsumer object and re-subscribe items.

How frequent is these kinds of disconnections? Do you recommend my application to keep attempting to connect continuously or fall-back after finite number of attempts (in all Closed/Suspect scenarios)? Is there a documentation somewhere explaining exact behaviour that is expected in these kinds of scenarios? Note that, for 'Force Logout from DACS' I already do this based on following answer.

Force Logout from DACS with WarmStandbyMode (Service Mode) - LSEG Developer Community

ThilinaI

Hi @wasin.w V3 , we were using same credentials in two environments, but issue was noticed only at one of them.

wasin.w V3

Hello @ThilinaI

Your understood of "if I get Closed/Suspect in the 'Status Message' for Login Domain —> I should destroy OMMConsumer object and re-subscribe items." message is correct.

I see that you are using the same credential in two environments. I am assuming that the credential is Machine-ID type (Authentication V1), am I correct? (see https://developers.lseg.com/en/article-catalog/article/account-authorization-v1-to-v2-migration-cheat-sheet )

If so, I highly recommend you reach out to your LSEG representative/Account Manager to get multiple Machine-IDs if you want to run multiple applications/sessions. The reason is if you use a single Machine-ID with multiple sessions, the applications may encounter an error when an access token expires or when the applications attempt to refresh an access token.

ThilinaI

Yes, it's V1.

Hope "Login Denied:Failed to validate sso token" issue is not related to same credentials being shared between multiple environments?

Regarding following,

"if I get Closed/Suspect in the 'Status Message' for Login Domain —> I should destroy OMMConsumer object and re-subscribe items."

Should i keep trying this continuously or better to fallback after finite number of attempts?

umer.nalla

Hope "Login Denied:Failed to validate sso token" issue is not related to same credentials being shared between multiple environments?

As my colleague explained, the issue is related to the single Machine-ID being used in mutiple applications/instances.

EXPLORE OUR SITES