Announcement Announcement Module
Collapse
No announcement yet.
HTTP Status 401 - Authentication Failed: Error validating SAML message Page Title Module
Move Remove Collapse
X
Conversation Detail Module
Collapse
  • Filter
  • Time
  • Show
Clear All
new posts

  • #16
    Hi,

    I go to www.ssocircle.com and remove localhost's metadata
    That rules out my previous hypothesis of IDP having metadata pointing to the local SP.

    I'm really shooting in the dark here. In order to be able to help you further I'd need you to:

    - enable tracing as is described in chapter 7.1 of the manual
    - enable tracing of certpath validation by adding system property javax.net.debug=all (-Djavax.net.debug=all)
    - restart the server and try again the SSO
    - send me all the resulting logs
    - send me list of content of your keyStore (keytool -list -keystore samlKestore.jks)
    - send me metadata you're importing to the IDP

    It might have something to do with the HTTP vs. HTTPS, but I don't have enough information to be able to tell. You can also send the data to [email protected]

    Vladi

    Comment


    • #17
      I just send the logs to you through email. Please help me identify this problem. Thank you very much.

      Comment


      • #18
        Hi,

        The reason for your server to reject the SAML response is:

        Response issue time is either too old or with date in the future, skew 60, time 2013-03-02T03:20:56.000Z
        And as I said in my first reply:

        One typical issue causing this is a difference between time of your server and IDP. Enabling NTP makes this go away.
        Just synchronize time on your server and you'll see the problem disappear. The skew time defines how big difference can there be between issuing and processing of the SAML response. The default value of 60 seconds can be changed for this case by setting property responseSkew on the WebSSOProfileConsumerImpl bean.

        Cheers, Vladi

        Comment


        • #19
          Thanks Vladi so much.

          Let me try to synchronize time and reply to you soon.

          Comment


          • #20
            Hi Vladi, your answer is correct. Thank you very much. I just synchronize time and it works well.

            Comment

            Working...
            X