Login looping on Chromebooks

[localzuk]

Has anyone experienced (and then found a consistent remedy for) login looping on Chromebooks?

 

We have ours set up so they use MS Entra SSO (so the users login to the MS login screen).

 

What we're seeing is users log in, it seems happy, goes through the motions of logging in, then kicks them back to the login screen again.

 

Searching around on here and the wider web, it seems to be an issue that has happened to lots of people but there doesn't seem to be a consistent remedy?

 

We've tried power washing and that hasn't remedied it for us. Got a couple of dozen devices doing it now (we've got about 800 in use).

[6Foot2]

If it's all your Chromebooks affected by this, can you move one of the devices to an OU in the admin console (it uses OUs, right?) where your (most recently changed?) policies don't apply, but the device is still enrolled?

[localzuk]

We've not changed any polices recently (not for over a year in fact), and all our OUs have the same policies.

 

Weirdly, some of the Chromebooks having this issue yesterday are working fine this morning...

[localzuk]

This is still happening here. I cannot trace what is causing it. It happens to random Chromebooks and random users. Sometimes no users can log into a Chromebook and it loops. Others, one specific user cannot log in and it loops, but other users can login fine.

 

Powerwashing doesn't solve it.

Waiting a few hours can clear it sometimes, sometimes not.

 

There's just no consistency at all.

[TwistedHelixis]

I look after a bunch of schools with different Chromebook types. I haven't come across this issue, although we are not using MS Entra SSO, so I would guess its something to do with that.

 

Have you tested the device completely off the school network, so its not getting any filtering?

[timbo343]

This is still happening here. I cannot trace what is causing it. It happens to random Chromebooks and random users. Sometimes no users can log into a Chromebook and it loops. Others, one specific user cannot log in and it loops, but other users can login fine.

 

Powerwashing doesn't solve it.

Waiting a few hours can clear it sometimes, sometimes not.

 

There's just no consistency at all.

What filtering solution are you using? We experienced a login loop on our chromebooks. We use a Smoothwall and the filtering and Aruba wireless was causing an issue.

 

We have been through 9 schools and created VLANs for all our chromebooks and specific SSIDs. The chromebooks have their own VLANs now and managing them on the Smoothwall is so much easier as all the filtering on the chromebooks is done via the cloud filter rather than onsite. We just have to make sure the VLAN can access the net and the Google Services for logging on and Authentication.

 

What happens if you take saod chromebooks off the network and use a "clean" unfiltered connection to the net. That would rule out any onsite filtering / firewall and point the finger at MS.

Edited January 17, 2024 by timbo343

[jthompson]

Google emailed out a link to this article today - https://support.google.com/chrome/a/answer/6334001

 

The email itself is referring to some upcoming changes (Feb 2024), but the linked article might help with troublshooting your Chromebook sign-in issue.

 

Dear EDU Administrator,

 

We are writing to let you know that starting February 2024, managed users may be unable to log-in to ChromeOS within your network following an upgrade to our sign-in infrastructure, unless you allowlist relevant hostnames.

 

What does this mean for your organization?

For users to work on ChromeOS devices in an enterprise network environment that utilizes TLS inspection (also known as SSL inspection), some hostnames need to be exempt from inspection, as explained in this support article.

 

What do you need to do?

Review and confirm that http://www.gstatic.com and ssl.gstatic.com are allowed in your enterprise network and exempt from TLS inspection. If these hostnames are not allowlisted, users may be unable to sign-in to their Chromebooks when connected to your enterprise network.

 

On February 16, 2024, the Google Team will begin an infrastructure migration that would require these hostnames.

 

Thanks for choosing Google for Education.

 

– The Google Chrome Team

[speakercon]

Did you have any luck with this?

 

I'm testing using Entra SSO and have this exact same problem. If I disable filtering it works so must be being blocked... I've tried entering many many URL's that google recomend to whitelist but I don't seem to be able to find the magic one that is causing the problem.

[PotNoodleTech]

I've only ever had this when theres been a problem with the LA's wifi.

 

Can you hot spot it to a 4g device and if the login loop goes away you know it's something to do with wifi/filtering/firewall

[TheHyperTechie]

I've only ever had this when theres been a problem with the LA's wifi.

 

Can you hot spot it to a 4g device and if the login loop goes away you know it's something to do with wifi/filtering/firewall

 

Was going to say^^^ Normally when I have seen this issue before, it is due to an issue with their ISP. You may need to ask them to ensure that all of the necessary URLs are unblocked for Google access.

[speakercon]

Yes its definitely the filtering (securly). I'll log a ticket with them.

[steveg]

Did you ever find any specific urls that were causing the issue? Ours have been working fine for a year and then yesterday started doing exactly this. No changes to the filtering for a while, and if I hotspot a Chromebook it works fine, so is definitely a filtering issue.

[speakercon]

I'm afraid not, I cheated and gave them the guest wifi DNS servers instead which got them working again. It doesn't matter as its overruled anyway by the correct policy from the browser extension.