Enforce is not able to validate the TLS certificate of the SAML server

Products

• Data Loss Prevention Enforce

Issue/Introduction

When configuring SAML authentication on Enforce, the server is not able to open the SAML authentication website and in the localhost logs, the following errors are logged:

17 Mar 2022 10:32:33,976- Thread: 18 SEVERE [org.springframework.security.saml.trust.MetadataCredentialResolver] PKIX path construction failed for untrusted credential: [subjectName='CN=<CommonName>,OU=<OrganizationalUnit>,O=<Organization>,C=<Country>']: unable to find valid certification path to requested target

Cause

The reason is that either the end certificate or the issuer certificate (root or intermediate CA) have not been imported to the SAML truststore on Enforce. The file is called samlKeystore.jks and its default location in DLP 15.8 is:

C:\Program Files\Symantec\DataLossPrevention\EnforceServer\15.8.00000\Protect\tomcat\webapps\ProtectManager\security

The path may change if a custom installation path was used, or for a different version of Enforce. 

Resolution

Obtain the required certificate - either of the SAML server itself, or the root/intermediate CA which issued the end certificate - and import them into the samlKeystore.jks file on Enforce. 

The import command, as well as instructions on how to extract the signing certificate from the idp-metadata.xml file, can be found in the below KB article:

Signature trust establishment failed for metadata entry for SAML (SSO) authentication