"Security Toke issuer not trusted" message when authenticating with Microsoft ADFS

Products

• Network Observability
• Spectrum

Issue/Introduction

The SAML integration with Micrsoft ADFS and Spectrum with a Internal Server 500 error. The tomcat log shows the following exception in the log file:

2024-03-22 14:12:27,429 [https-jsse-nio-8443-exec-6] INFO  org.apache.cxf.fediz.core.processor.SAMLProcessorImpl - Issuer url: https://adfsserver/adfs/ls/
2024-03-22 14:12:27,936 [https-jsse-nio-8443-exec-8] INFO  org.apache.cxf.fediz.core.processor.SAMLProcessorImpl - Issuer url: https://adfsserver/adfs/ls/
2024-03-22 14:12:48,590 [https-jsse-nio-8443-exec-7] WARN  org.apache.cxf.fediz.core.saml.SAMLTokenValidator - Issuer 'http://adfsserver/services/trust' not trusted
2024-03-22 14:12:48,591 [https-jsse-nio-8443-exec-7] ERROR com.aprisma.spectrum.app.sso.saml2.SamlTomcatSigninHandler - Security token issuer not trusted
org.apache.cxf.fediz.core.exception.ProcessingException: Security token issuer not trusted

 

SAML debug shows the ADFS server showing a status code of "Responder" Not "Success"

Environment

DX NetOps Spectrum 23.3.6

Cause

The system time was off by 3 minutes on the Microsoft ADFS server. The system times must be in sync for Microsoft ADFS to authenticate successfully.

Resolution

The System time on the Microsoft ADFS server needed to be in sync with the OneClick server. Once the time was synched on both the OneClick server and the Microsoft ADFS server the customer was able to authenticate successfully.