Announcement Announcement Module
Collapse
No announcement yet.
HTTP Status 401 - Authentication Failed: Error validating SAML message Page Title Module
Move Remove Collapse
X
Conversation Detail Module
Collapse
  • Filter
  • Time
  • Show
Clear All
new posts

  • HTTP Status 401 - Authentication Failed: Error validating SAML message

    Hi everyone, I have a problem like this:

    I can do SSO with my project on localhost but when I deploy its war file to tomcat server on the internet it does not work. For detail, when I choose IDP and click on button login it redirects to web portal. After that I input username and password to login and it returns 401 Error Authentication Failed. It's strange because my project works well on localhost. Please help me for this problem.

    Thanks & Regards.

    Attachment
    Attached Files

  • duybinh0208
    replied
    Hi Vladi, your answer is correct. Thank you very much. I just synchronize time and it works well.

    Leave a comment:


  • duybinh0208
    replied
    Thanks Vladi so much.

    Let me try to synchronize time and reply to you soon.

    Leave a comment:


  • vsch
    replied
    Hi,

    The reason for your server to reject the SAML response is:

    Response issue time is either too old or with date in the future, skew 60, time 2013-03-02T03:20:56.000Z
    And as I said in my first reply:

    One typical issue causing this is a difference between time of your server and IDP. Enabling NTP makes this go away.
    Just synchronize time on your server and you'll see the problem disappear. The skew time defines how big difference can there be between issuing and processing of the SAML response. The default value of 60 seconds can be changed for this case by setting property responseSkew on the WebSSOProfileConsumerImpl bean.

    Cheers, Vladi

    Leave a comment:


  • duybinh0208
    replied
    I just send the logs to you through email. Please help me identify this problem. Thank you very much.

    Leave a comment:


  • vsch
    replied
    Hi,

    I go to www.ssocircle.com and remove localhost's metadata
    That rules out my previous hypothesis of IDP having metadata pointing to the local SP.

    I'm really shooting in the dark here. In order to be able to help you further I'd need you to:

    - enable tracing as is described in chapter 7.1 of the manual
    - enable tracing of certpath validation by adding system property javax.net.debug=all (-Djavax.net.debug=all)
    - restart the server and try again the SSO
    - send me all the resulting logs
    - send me list of content of your keyStore (keytool -list -keystore samlKestore.jks)
    - send me metadata you're importing to the IDP

    It might have something to do with the HTTP vs. HTTPS, but I don't have enough information to be able to tell. You can also send the data to [email protected]

    Vladi

    Leave a comment:


  • duybinh0208
    replied
    Hi Vladi, I just test my project on another server (using http) and it works well but with old server (using https) it still occurs the error 401. I think the problem is the difference between http and https SSL. Do you think about this problem?

    Leave a comment:


  • duybinh0208
    replied
    Hi Vladi,
    1) In localhost: http://localhost:8080/my_sample_v2/s...urnIDParam=idp
    2) In real server: https://myserver.com/my_sample_v2/sa...urnIDParam=idp
    3) In securityContext.xml I just config default sp metadata with entityID is "mysample.com" like this:
    <bean id="metadataGeneratorFilter"
    class="org.springframework.security.saml.metadata. MetadataGeneratorFilter">
    <constructor-arg>
    <bean class="org.springframework.security.saml.metadata. MetadataGenerator">
    <property name="entityId" value="mysample.com" />
    <property name="signMetadata" value="false" />
    </bean>
    </constructor-arg>
    </bean>
    4) First, I go to www.ssocircle.com and remove localhost's metadata. Second, I run my project on real server and it automatically generate default sp metadata. Afterthat I just copy this sp metadata and import to SSOCirle.com. Anything else is wrong here?
    Last edited by duybinh0208; Feb 28th, 2013, 08:48 PM.

    Leave a comment:


  • vsch
    replied
    Do you use exactly the same URLs to access your application when deploying on the localhost as when you deploy on the real server? (e.g. http://www.myserver.com/app)? This is a pre-requisite for your configuration to work. Otherwise you need to generate two separate metadata documents - one for your localhost config and another for your server config, for each of them use a different entityID and import them both to the IDP.

    Vladi

    Leave a comment:


  • duybinh0208
    replied
    I just name the entityID of service metadata is "mysample.com" and this sp metadata can be imported by SSOCircle IDP. Furthermore, I can login successful in localhost. Thus, I think my entityID is right. But I don't understand why my project cannot do SSO when I deploy it to real server (on internet).
    Last edited by duybinh0208; Feb 28th, 2013, 11:11 AM.

    Leave a comment:


  • vsch
    replied
    I don't see any problem in the metadata declaration in the code above. What I had in mind in the previous post is updating your SP metadata on the IDP side.

    V.

    Leave a comment:


  • duybinh0208
    replied
    I just update idp metadata in securityContext.xml like this:

    <bean id="metadata"
    class="org.springframework.security.saml.metadata. CachingMetadataManager">
    <constructor-arg>
    <list>
    <bean class="org.opensaml.saml2.metadata.provider.HTTPMe tadataProvider">
    <constructor-arg>
    <value type="java.lang.String">http://idp.ssocircle.com/idp-meta.xml</value>
    </constructor-arg>
    <constructor-arg>
    <value type="int">5000</value>
    </constructor-arg>
    <property name="parserPool" ref="parserPool" />
    </bean>
    </list>
    </constructor-arg>
    </bean>

    Do I update it correctly?

    Leave a comment:


  • vsch
    replied
    Hi, the config looks ok to me. The PKIX validation depends more on content of your KeyStore. I'd really go with the extra logging and see what exactly fails... Also, do you have a different entityId between your local and server environments? Have you correctly updated the IDP metadata? Perhaps there's some inconsistency in the namings.

    Leave a comment:


  • duybinh0208
    replied
    HTTP Status 401 - Authentication Failed: Error validating SAML message

    Hi Vladi this is my securityContext.xml file. I wonder if I config something else wrong? Can you review it for me? Thank you very much.

    Attachment
    Attached Files

    Leave a comment:


  • vsch
    replied
    Hi,

    Yes I saw it, but the exception is present only in the first SSO attempt, the second attempt doesn't have it anymore and getting more logs might reveal what's the reason for it. Also, few revisions back there was a fix for situation when this error is displayed even in cases when PKIX validation ultimately succeeds and I'm not sure whether that might be your case.

    You should generate a new private key for production instance, but it's not mandatory. In other words you can deploy the default samlKeystore.jks at a server and expect it to work.

    The PKIX validation can e.g. when IDP or SP certificate is expired, IDP metadata is not imported correctly, a CA certificate for SSL/TLS connection is not imported to the keystore.

    Vladi

    Leave a comment:

Working...
X