Error : NO_SAML_REQUEST_OR_SPID in SAML SP Initiated POST request
Article ID: 37629
Updated On:
Products
Issue/Introduction
When running Federation Services, and a user attempts a SP
initiated POST request, the user receives 400 error. The following is
written to the FWSTrace.log:
Transaction with ID:
2b474df9-cc268318-a53293bf-1b3bb99d-7e444b1a-eb failed. Reason:
NO_SAML_REQUEST_OR_SPID
No SAMLRequest or SPID parameter in request to SAML2 Single Sign-On
Service.
The request ends SAML2 Single Sign-On Service request processing with
HTTP error 400.
Environment
Siteminder Federation R12.52 and higher, all platforms (prior to
version 12.52, only the redirect binding was supported for
SP-initiated requests; SP-initiated requests via POST were not
supported until R12.52).
Cause
Assuming the SAMLRequest parameter included in the POST data is
properly formatted and contains the expected data, this error is most
often caused by not having the Policy Server's Session Store enabled.
When an unauthenticated user submits a SP Initiated POST request, the
Policy Server needs a mechanism for holding the post data during the
series of redirects that occur during authentication.
The Policy Server requires the Session Store for this (please note
that persistent sessions are not required for this use case; enabling
the Session Store is sufficient).
Without the Session Store enabled, the POST data is lost during
authentication, and thus when the user returns to the saml2sso URL, it
is now a GET request and the query sting looks similar to this:
SMASSERTIONREF=QUERY&SAMLTRANSACTIONID=432ef752-62ed604b-5494401a-6de5813d-7f35e66c-8
This problem can also occur if a valid session cookie is not presented
upon return to saml2sso after authentication. Such a scenario can
occur if the authentication URL and saml2sso are not in the same
cookie domain, or if flags are set on the session cookie such that the
browser will not present the cookie to the saml2sso URL. The same
error as above will occur, caused by the request URL not containing
sufficient information to determine the proper Authentication URL.
Note that this problem will not occur for an authenticated user who
submits an SP initiated POST request. This is because the saml2sso URL
can process the POST data immediately without redirecting the user for
authentication.
Resolution
Configure and enable the Session Store on the Policy Server (this is
done in the Policy Server Management Console on the Data tab and does
require a restart of the Policy Server to take effect).
Workaround:
If a Session Store cannot be enabled for any reason, the only
workaround is to only allow the redirect binding for SP Initiated
requests. This moves the SAMLRequest parameter to the URL and does not
require the Session Store to be enabled.
Feedback
