SAML login fails for IDPs bootstrapped from uaa.yml after upgrading opsman to 3.3.1

Products

• VMware Tanzu Platform Core

Issue/Introduction

A SAML IDP configured in uaa.yml with a URL-type metadata location (metadataTrustCheck: true + metaDataLocation: https://...) cannot authenticate users. Two distinct failure modes are observed depending on which ACS URL the IDP targets:

Failure 1 — relying_party_registration_not_found (primary reported symptom)

When the IDP posts its SAML response to the IDP-alias ACS URL (/saml/SSO/alias/{idpAlias}), UaaRelyingPartyRegistrationResolver.resolveFromRequest performs an endsWith check against the SP entity-ID alias. Because the IDP alias does not end with the SP alias string, the resolver returns null, and Spring Security throws:

Saml2AuthenticationException{error=[relying_party_registration_not_found]
  No relying party registration found}

 

Failure 2 — invalid_issuer (secondary; same root cause)

When the IDP posts to the canonical SP ACS URL (/saml/SSO/alias/{spAlias}), the issuer is extracted from the SAML response and used to look up the IDP by external_key. Because external_key is null for URL-type bootstrap IDPs (see root cause below), the lookup returns nothing. The default-stub registration is returned instead, and Spring Security throws:

Saml2AuthenticationException{error=[invalid_issuer]
  Invalid issuer [https://idp.example.com/...]}

Environment

Tanzu Operations Manager v3.3.0 - v3.3.2

Cause

The issue is due to known defect which is being traced at https://github.com/cloudfoundry/uaa/pull/3933.

Resolution

Workaround:

Directly go to https://OPS-MAN-FQDN/classic/

 

Long term Fix:

To upgrade to Tanzu Operations Manager v3.3.3+