App runs in a Browser and does not sign-in the app

[streetgrover]

When attempting to log in to the SAP Concur Mobile App, it forces a web-browser interface within the app for any username/password entering method. After signing in, using any sign-in method (username/password, SSO, etc.) it loads the web interface and does not allow the application to open. This is not usable at all and I am frustrated that I can't get the application to work outside of the browser sign-in window within the app. This is a huge hindrance to my workflow and I can no longer upload receipts, submit reports, or book work travel like I used to.

Please address this issue with an App update or help me find a workaround.

Thanks,

Screenshots of the issue are provided below:

[johnsol5 · Accepted solution]

This morning I was able to get in, I am on IOS 18 BETA, but my users were not, so I went and checked if Concur had an app update on my device and it did. So I updated to version 10.15.1 and now I too cannot get in to Concur via mobile app.

10/01/2024 - to update readers:  I have verified with multiple iPhone users with various phones and system versions, IOS all versions work up through Concur mobile app version 10.14.0.2409031209 Even IOS Beta 18.1 (22B5054e), but as soon as you update the Concur Mobile app to any version after that it does not work.

So far with my ticket in with Concur has stated the following (i.e. major change with NO communications to Admins that I can find). I have asked for documentation of this and we are looking at our SSO now too. Will come back and update if we fix on our side. 

Concur has incorporated a relaystate parameter in the authentication request. It is crucial to collaborate with your IT team to ensure that the relaystate query string parameter is permitted/enabled. They should be able to identify where relaystate is not being passed along and determine where it is being dropped.

Depending on the IdP configuration, certain customers may be set up to use the IdP-initiated endpoint (such as Ping), which may not be configured to accept relayState. As a result, a more extensive reconfiguration of their IdP is required.

Additionally, in the same scenario, clients have the option and are encouraged to transition to SAML2, which follows a proper SP-initiated SSO flow. The effort required to reconfigure the IdP and transition to SAML2 is comparable.

[Andras]

Hi everyone! @vperlutchi  @streetgrover  @Ev46f  @tenders 

We understand your frustration and apologize for the inconvenience this has caused.

Based on the latest update from our team, it appears that the root cause of this issue is related to a SAML setting within customers' Mobile Device Management (MDM) or Identity Provider (IdP) solutions. Here's what needs to be done:

1. For Customers Using MDM (company phone):

   • Please reach out to your IT team to ensure that they are allowing the relaystate query string parameter from the mobile browser and the POST body to the IdP. This setting should help resolve the SSO issue.

2. For Customers Not Using MDM (private phone):

   • We will need a .HAR file to further investigate the issue. Your IT team can assist you in generating this file. Once you have it, please attach it to the support case for further analysis.

[Ev46f]

I’ll pass this on to the IT team at my company of 100,000 employees so that they can troubleshoot an issue with your app…….

 Or……you could update your app to patch the issue. 

[Ev46f]

I sent this up the chain and they basically said no. They’re not going to change back end settings for over 100,000 employees because someone in the sap forum said they needed to. You guys need to acknowledge the problem and either commit to a patch timetable or send a bulletin to the IT departments directly guiding them on the changes needed

[streetgrover]

@Andras,

To ensure that this issue can be resolved for all users, I created the .HAR file requested. I fall under the category for Customers Not Using MDM; I am using my personal iPhone to sign in to the app.

For the .HAR file, can you clarify where I can upload this for review? I cannot attach the file to this post.

Thanks

[mgrossi41]

This can not be the actual fix.  SAP Concur has 1000s of clients with millions? of employees...you can't expect us to try to get our IT dept to make some change based on a community forum.  The APP needs to be fixed.  And (for some reason) that's not possible, actual real communication needs to be sent out to ALL of your customers with instructions on what would be needed...but that doesn't seem like a good fix to me.  We use a couple other SSO apps and after IOS 18 update, those are all working fine.  

[JAH-35029]

Just wanted to post on this thread to state my company is have this EXACT issue with ONLY iOS18 devices. The SAP mobile app on Android devices and iPhones that haven't upgraded to iOS18 are working without any issues. 

[png148]

My company is having the exact same issue.  Concur app is not working for any devices on iOS18. Our devices are managed via MDM and SSO. Even with last night Concur app update to version 10.15, it is still not working.  We experienced a similar issue with another vendor app, and they released an updated app that fixed the issue immediately. Did anyone have any success with below:  

• Please reach out to your IT team to ensure that they are allowing the relaystate query string parameter from the mobile browser and the POST body to the IdP. This setting should help resolve the SSO issue.

[seanmcirrus]

So, "IT Team" here, and that statement "please reach out to your IT team to ensure that they are allowing the relaystate query string parameter from the mobile browser and the POST body to the IdP." is not telling us much. If something changed on how SSO for Concur works, please update your documentation. Seeing as this works on my older iOS 16 device but not on my iOS 18 device, it seems to be something with the App. Can someone at Concur provide more detail or a link to documentation on what we need to "ensure"?

[seanmcirrus]

Shock and awe!! While trying to troubleshoot for our IDP provider and get a log, I was able to successfully login with SSO. WE CHANGED NOTHING!! So Concur, what did you fix and didn't want to tell us for several weeks??

[LM730]

Our Company is having the same issue, limited only to those on iOS18. 

We use personal mobile devices in combination with SSO. 

Having reached out to our IT team, we're waiting on SAP to fix this from your end.

[tenders]

9/26 at 5:30pm ET - exciting! Another app update, this time to 10.15.1!

NO CHANGE. APP IS STILL BROKEN. 462MB download to use a too-small website.

[digsaishu]

Concur has been saying the same thing for last 2 weeks with no solution. We have a case with them and no progress. Really frustrating. 

[atxwaldo]

We're having the same issue (ios18 with Concur 10.15) goes into a loop after authentication. Any updates? Maybe it is a bug in iOS 18 or maybe it's a bug in Concur.  We don't care, we just have angry users who want to use the app and SAP should have the ability to pinpoint where the problem is at and provide a resolution. BTW, our IDP is Okta and we're working with them as well. 

[mik3]

We've had employees try everything suggested from the SAP Concur employee listed in this post, and nothing has worked personal or business devices. Is there an approximate timeline for a fix regarding this issue? This seems to be a widespread issue affecting potentially millions of Concur users worldwide.

[Andras]

Hi everyone!

Does anyone have Concur Support case opened?

Can you please share with the case number via PM?

Thank you!

[timothyshea]

I am still having this issue ... i have tried uninstalling and reinstalling the concur app

I am using iPhone 16 Pro Max

Personal Device

Concur 10.15.1

iOS 18.0

[mik3]

An employee at my company informed me that he was able to figure out a work around...instead of logging in with Okta Push, use the mobile SMS text code. This allowed him to log in across all of his devices. The issue could be related to Okta Push verification. Hopefully this helps. 

[LM730]

That's incredible, just tried this but instead used the code sent over email rather than SMS. 

We use PingID here for 2FA and seems you're onto something with Push notifications being the culprit in part.
Thanks for sharing mik3! 

Will be sure to follow up with SAP using the caseID we have opened. 

[LM730]

Little update, looks like that's no longer necessary anyway. 
SAP have made updates from their end which seems to have resolved the issue completely. 

Thank you still!

[tenders]

Thank God, this global nightmare is finally over. My Concur apps are both working again under iOS18. Hooray and thank you.

[streetgrover · Accepted solution]

The SAP Concur App is finally behaving correctly when logging in!

This is the first time the app has worked since the iOS 18 public beta. Initially after updating to iOS 18, this app prevented the login screen from progressing into the full app experience. To provide further information, my device is:

• iPhone 15 Pro
• Developer beta iOS 18.1 (22B5054e)
• App Verison 10.15.1

Hopefully, this is fixed for all users!