Process SAML Authentication Request will break on submission of different Binding
Article ID: 105734
Updated On:
Products
CA API Gateway (Layer 7)
SA94 to API SECURITY
STARTER PACK-7
CA Rapid App Security
MOBILE API GATEWAY
CA Mobile - API Gateway
CA API Gateway
Issue/Introduction
When a request comes for Process SAML Authentication Assertion with invalid SAML request or invalid binding (POST in case of REDIRECT or vice-versa), the assertion fails entire policy. If this assertion is part of All assertions must be true, then it doesn't come out of it in case of invalid SAML request or invalid binding, it fails the entire policy.
Environment
Release:
Component: APIGTW
Component: APIGTW
Resolution
API Gateway v9.3.00 CR03,API Gateway v9.2.00 CR10
Additional Information
Workaround [Optional]:
Workaround is to include a 'Validate HTML Form Data' and check on the correct submission method for the 'Process SAML Authentication Request'
Workaround is to include a 'Validate HTML Form Data' and check on the correct submission method for the 'Process SAML Authentication Request'
Feedback
Yes
No
Powered by
