CODEWITHSUNDEEP
single-sign-onsaml-2.0wso2-identity-server
Kalema Edgar
Kalema Edgar

Reputation: 399

WSO2 identity server - SAML2 Response Issuer verification failed

I am using the wso2 sample apps (saml2-web-app-pickup-dispatch and saml2-web-app-pickup-manager) to test single sign on through WSO2 identity server version 5.10.0

The deployment is fine and on clicking the application's login, it redirects to the WSO2 login page successfully.

User logs in successfully but receives error below.

HTTP Status 500 – Internal Server Error
Type Exception Report

Message SAML2 Response Issuer verification failed

Description The server encountered an unexpected condition that prevented it from fulfilling the request.

Exception

org.wso2.carbon.identity.sso.agent.exception.SSOAgentException: SAML2 Response Issuer verification failed
    org.wso2.carbon.identity.sso.agent.saml.SAML2SSOManager.processSSOResponse(SAML2SSOManager.java:569)
    org.wso2.carbon.identity.sso.agent.saml.SAML2SSOManager.processSSOResponse(SAML2SSOManager.java:525)
    org.wso2.carbon.identity.sso.agent.saml.SAML2SSOManager.processResponse(SAML2SSOManager.java:358)
    org.wso2.carbon.identity.sso.agent.SAML2SSOAgentFilter.doFilter(SAML2SSOAgentFilter.java:98)
Note The full stack trace of the root cause is available in the server logs.

Apache Tomcat/8.5.53

Logs from the server

TID: [-1234] [2020-04-25 19:16:55,881] [7e977cfd-8304-44ba-ab4f-4644baff988e]  INFO {AUDIT_LOG} - 
Initiator : wickrema | Action : Login | Target : ApplicationAuthenticationFramework | 
Data : { 
   "ContextIdentifier" : "51f93b05-68cf-4bf4-b62b-51e3e2502889",
   "AuthenticatedUser" : "wickrema",
   "AuthenticatedUserTenantDomain" : "carbon.super",
   "ServiceProviderName" : "saml2-web-app-pickup-dispatch",
   "RequestType" : "samlsso",
   "RelyingParty" : "saml2-web-app-pickup-dispatch.com",
   "AuthenticatedIdPs" : "eyJ0eXAiOiJKV1QiLCAiYWxnIjoibm9uZSJ9.eyJpc3MiOiJ3c28yIiwiZXhwIjoxNTg3ODMxNDE1ODA0MzAwMCwiaWF0IjoxNTg3ODMxNDE1ODA0LCJpZHBzIjpbeyJpZHAiOiJMT0NBTCIsImF1dGhlbnRpY2F0b3IiOiJCYXNpY0F1dGhlbnRpY2F0b3IifV19." 
} | Result : Success

Upvotes: 0

Views: 576

Answers (1)

Nipun Thathsara
Nipun Thathsara

Reputation: 1149

Your Service Provider application(Pickup-Dispatch) is trying to verify if the received SAML response is issued by the expected SAML Identity Provider. WSO2 includes its ID in the SAML response's <saml:Issuer> tag.

Your application has a pre-configured entity ID for WSO2 in the saml2-web-app-pickup-dispatch.com/WEB-INF/classes/sso.properties file as below.

SAML2.IdPEntityId=localhost

Likewise, WSO2 IS populates its SAML response's issuer with the value you've configured in the Resident Identity Provider's Home Realm Identifier. enter image description here But you can override the Home realm identifier with the IdP Entity ID Alias of your Service Provider SAML configurations as below. enter image description here

Bottom line, the Issuer ID of the SAML response should be the same as what you've configured in the Application as the IdP Entity ID.

Change either value to make them the same.

Code for your reference

Upvotes: 4

Related Questions