SSO SAML Certificate Verification Errors: Redirect Loop to Console Login

Products

• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Enterprise EDR

Issue/Introduction

HAR file or UI shows invalid_request errors:

• configuration requires the SAML response to be verified but no certificates were configured for verification state
• SAMLResponse received from IDP is signed but it could not be verified using the certificate configured
•  

Environment

• Carbon Black Cloud: All Supported Versions
• SAML Provider

Cause

This error is caused by a certificate mismatch between your Identity Provider (IdP) and the Broadcom/AuthHub backend. This typically occurs when the certificate in the IdP has expired or has been reconfigured, but the Broadcom/AuthHub backend has not been updated to match.

Resolution

1. Log in to your Identity Provider (IdP) and locate the SAML application configured for Carbon Black Cloud / AuthHub.
   • If IdP App is referencing URL https://defense-<backend>.conferdeploy.net/login/saml/consume, it will not work.  This URL has been deprecated and with replaced with the correct IDP settings. 
   • If you have multiple SAML applications configured, ensure you select the correct one. Providing the XML from the wrong application will result in the exact same certificate error.
2. Export the SAML Metadata configuration file (XML).
3. Provide this exported file to Technical Support so they can update your backend configuration.

Additional Information

• Troubleshooting Console Redirection
• Modify SAML IDP Settings For Carbon Black Cloud