When configuring SAML authentication on Enforce, the server is not able to open the SAML authentication website and in the localhost logs, the following errors are logged:
17 Mar 2022 10:32:33,976- Thread: 18 SEVERE [org.springframework.security.saml.trust.MetadataCredentialResolver] PKIX path construction failed for untrusted credential: [subjectName='CN=<CommonName>,OU=<OrganizationalUnit>,O=<Organization>,C=<Country>']: unable to find valid certification path to requested target
The reason is that either the end certificate or the issuer certificate (root or intermediate CA) have not been imported to the SAML truststore on Enforce. The file is called samlKeystore.jks and its default location in DLP 15.8 is:
The path may change if a custom installation path was used, or for a different version of Enforce.
Obtain the required certificate - either of the SAML server itself, or the root/intermediate CA which issued the end certificate - and import them into the samlKeystore.jks file on Enforce.
The import command, as well as instructions on how to extract the signing certificate from the idp-metadata.xml file, can be found in the below KB article: