Submit Feedback
Legacy Knowledge Base
Published Jul. 2, 2025

Cookie login failure (Cookie invalid or empty) in mobile SDK applications with SAML activated

Written By

Georgel Pop

How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!

While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.

Legacy Article

You are viewing an article from our legacy "FastTrack" publication program, made available for informational purposes. Articles in this program were published without a requirement for independent editing or verification and are provided"as is" without guarantee.

Before using any information from this article, independently verify its suitability for your situation and project.

Issue

  • After activating SAML in their portal, an application developed using Mobile SDK fails to log in with the following error (Could not login ... Cookie invalid or empty):
    2021-05-27 11:00:18.818 17236-17236/my.custom.app E/LiferayScreens: Could not login 
com.liferay.mobile.android.exception.AuthenticationException: Cookie invalid or empty 
    at com.liferay.mobile.android.auth.CookieSignIn.parseAuthToken(CookieSignIn.java:161) 
    at com.liferay.mobile.android.auth.CookieSignIn.parseResponse(CookieSignIn.java:177) 
    at com.liferay.mobile.android.auth.CookieSignIn.signIn(CookieSignIn.java:70) 
    at com.liferay.mobile.screens.auth.login.interactor.LoginCookieInteractor.execute(LoginCookieInteractor.java:35) 
    at com.liferay.mobile.screens.base.interactor.BaseInteractor$1.run(BaseInteractor.java:29) 
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167) 
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641)
    at java.lang.Thread.run(Thread.java:923)2021-05-27 11:00:18.826 17236-17236/my.custom.app E/my.custom.app: Invalid ID 0x00000000.2021-05-27 11:00:18.846 17236-17236/my.custom.app D/my.custom.app.view.activity.LoginActivity: FAILURE LOGIN 
com.liferay.mobile.android.exception.AuthenticationException: Cookie invalid or empty at com.liferay.mobile.android.auth.CookieSignIn.parseAuthToken(CookieSignIn.java:161) 
    at com.liferay.mobile.android.auth.CookieSignIn.parseResponse(CookieSignIn.java:177) 
    at com.liferay.mobile.android.auth.CookieSignIn.signIn(CookieSignIn.java:70) 
    at com.liferay.mobile.screens.auth.login.interactor.LoginCookieInteractor.execute(LoginCookieInteractor.java:35) 
    at com.liferay.mobile.screens.base.interactor.BaseInteractor$1.run(BaseInteractor.java:29) 
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167) 
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641) 
    at java.lang.Thread.run(Thread.java:923)

Environment

  • DXP 7.0 or higher

Resolution

  • In this case the solution would be to use OAuth2 login method, redirecting to IdP (Identity provider) for login and, when successful, returning to the application having the role of SP (Service Provider).
  • The flow in the test-app application to make an OAuth2 redirect is the following:
    1. In LoginOAuth2RedirectInteractor.java#L32 use the Mobile SDK method signInWithRedirect from OAuth2SignIn.java#L45 to open a page Web View to log in.
    2. In the browser, the user is redirected to log in on the IdP (practically the normal login flow done in a browser after activating SAML).
    3. Once the login is successful, Authorization is requested so that the OAuth2 application can process this information.
    4. If we have the permission and authorize the OAuth2 application, it returns to verify the response in this LoginOAuth2ResumeRedirectInteractor.java#L28 method that calls the Mobile SDK resumeAuthorizationFlowWithIntent method in OAuth2SignIn.java#L25.
    5. The response is verified in TokenRequester.java#L88 and if everything has been successful, the user would be authenticated at this time.
  • For all this to work, it will be necessary to follow these steps to configure your OAuth2 application:
    1. Go to Control Panel -> Settings -> OAuth2 Administration.
    2. With the plus button (+) Add OAuth2 application, specify a name and a callback URI we use in server_context.xml#L11 (you need to identify which one corresponds to yours in AndroidManifest.xml#L69). The rest is left as is. Click Save:
    3. We open the Scopes tab and in Portal Services we select all the available options (these are necessary to login, but others can be added if needed):
    4. We return to OAuth 2 Applications and on the right, in our application created in step 1, click on the 3-dot-icon context menu and select the "Permissions" option.
    5. By default, the Admin users have all the permissions, but for the other users to be able to authorize the application they need the 'Create token' and 'View' permissions:
  • With this, we will have everything that is needed to make a successful login with OAuth2 redirect when SAML is activated in the portal.

Additional Information

 

Did this article resolve your issue ?
Legacy Knowledge Base
Did this article resolve your issue ?