usercheck block page don't load to some local hosts

[LuisSP]

Firewall NGTX 1490 with R77.20.86.

Hi again checkmate. I have another case: the usercheck blocking page is only loaded on some local hosts in your browsers. On computers with problems, only an internal 500 server error appears in browsers. I do not find a pattern in such behavior. The version of the browsers is the same, I tried with different browsers but the error persists.

The last thing I did was uninstall extensions in Chrome but it did not work, then I used the ethernet interface (I was using wifi) and, surprisingly, the user verification lock page could be loaded in the browser. So I disabled Ethernet and again enabled Wi-Fi, but assigned another IP address and again the usercheck lock page appeared.

I think that something inside the firewall is wrong (some table maybe) and is linked to the IP address. I'm going to try another problematic computer to confirm my suspicions.

Any ideas please?

[PhoneBoy]

I would open a TAC case so we can investigate this.

[LuisSP]

I already opened a case yesterday, thank you. As soon as I have a solution, I'll mention it here.

[PhoneBoy]

Hi, I saw your response in the moderation queue in Spanish.
English is generally what we use to communicate on CheckMates and we don't (yet) have a Spanish-speaking place.
To address the points you raised:

1. I cannot open a TAC ticket on your behalf, you will need to do this (either directly or through your partner).
2. Yes, changing the MAC address will give you a different IP allocation via DHCP. It seems odd that it works for a period of time after doing this, then stops working.

[LuisSP]

Hello again, so that this thread don't remain unfinished, I comment that the TAC helped me to solve the problem, however I was left with doubts.

The TAC referred to sk122097, which mentions that the cause of this error is due to "... an Active Directory configured on non Latin characters and implemented with Identity Awareness blade locally managed SMB appliances. Only Latin characters are supported on Locally managed SMB"

Well, my doubts:
1.- The previous scenario was partially presented to me, since although we use AD with the IdAw blade, said AD is configured in Spanish (Mexico), which uses latinic characters. In addition, the problem only appeared with users who had some accented letter in their full name (not the user name). By removing the accents (´) from the names, the problem was corrected.
2.- Accents are typical of Latin characters, we accentuate words, so it does not match the sk122097 scenario.
3.- Why when changing IP, the problem was temporarily corrected, if the character set remained the same?

In our case it was possible to remove the accents, because the number of users and company policies allowed it ... but if that had not been the case?

Well, I just wanted to share my experience. See you soon.

[G_W_Albrecht · Accepted solution]

Your doubts are just missing knowledge - look into Wikipedia:

The ISO basic Latin alphabet is a Latin-script alphabetand consists of two sets of 26 letters, codified in various national and international standards and used widely in international communication. They are the same letters that comprise the English alphabet.

The two sets contain the following 26 letters each:

ISO basic Latin alphabet

UppercaseLatin alphabet	A	B	C	D	E	F	G	H	I	J	K	L	M	N	O	P	Q	R	S	T	U	V	W	X	Y	Z
LowercaseLatin alphabet	a	b	c	d	e	f	g	h	i	j	k	l	m	n	o	p	q	r	s	t	u	v	w	x	y	z

So accents, umlauts and other diacritic characters are neither part of the latin character set nor can be used with CP products, also see:

sk156933 Wireless LAN configuration fails if it includes diacritic characters

[Zolo]

Hello @LuisSP ,

I have the same problem.

My experience is that if the user's full name is ANSI-encoded (Windows-1252), the accents cause problems.

But if it's UTF-8 encoded, it works like a charm.

So accents can be used in case of UTF-8 encoding.

I tried it in a demo environment by modifying the /opt/CPUserCheckPortal/phpincs/web/actions/UserCheckIncidentDataAction.php file by adding this: 

$UserID = utf8_encode($UserID); 

@@ -38,6 +38,7 @@

if($UserID == NULL)
$UserID = "";
+ $UserID = utf8_encode($UserID);
$output = $this->GetIncidentData($IncidentID, $UserID, $UserLang, $GetCancelPage);
if (isset($output->Variables['product']) && $output->Variables['product'] == 'Threat Extraction')
{

But of course this is not a solution in a productive environment 😁