FAILED_INVALID_RESPONSE_RETURNED in SPS WAOP Federation Services

Products

• SITEMINDER
• CA Single Sign On Federation (SiteMinder)
• CA Single Sign On Secure Proxy Server (SiteMinder)

Issue/Introduction

When running Federation Services on Web Agent Option Pack or CA Access Gateway (SPS), what are the possible causes and solutions when the following error message shows up in the FWStrace.log?

  FAILED_INVALID_RESPONSE_RETURNED

This usually leads the browser to receive error 500.

 

Resolution

This error is generic, and can mainly be caused by several reasons:

1. The Authnrequest is signed in a POST request:
   
   Error: FAILED_INVALID_RESPONSE_RETURNED in SP Web Agent Option Pack
   https://knowledge.broadcom.com/external/article?articleId=141423
   
   
2. The Policy Server gets a problem retrieving the certificate for the assertion signature validation:
   
   Error: FAILED_INVALID_RESPONSE_RETURNED and issuer dn is empty or null
   https://knowledge.broadcom.com/external/article?articleId=113610
   
   
3. No Persistent realm nor Session Store enabled:
   
   Error: FAILED_INVALID_RESPONSE_RETURNED by enabling SLO in Federation
   https://knowledge.broadcom.com/external/article?articleId=7260
   
   Error: Denying request due to "NO" from SAML2 assertion generator
   https://knowledge.broadcom.com/external/article?articleId=250099