Spectrum integration with SAML fails with error 500

Products

• Network Observability
• Spectrum

Issue/Introduction

OneClick configured with SSO using an Identity Provider (IdP) that supports SAML 2.0 returns an error 500 after authentication. The user is redirected back to the OneClick home page and denied access.

The tomcat log file (catalina.out or stdout.log) shows the following messages:

ERROR com.aprisma.spectrum.app.sso.saml2.SamlTomcatSigninHandler - The request was invalid or malformed
org.apache.cxf.fediz.core.exception.ProcessingException: The request was invalid or malformed
DEBUG org.apache.cxf.fediz.core.samlsso.SAMLProtocolResponseValidator - SAML Status code of urn:oasis:names:tc:SAML:2.0:status:Responder does not equal urn:oasis:names:tc:SAML:2.0:status:Success

 

In some cases, the logs may also indicate: Receive StatusCode: urn:oasis:names:tc:SAML:2.0:status:Responder. Message: Authentication Failed

When Spectrum SAML debug is enabled we see the following in the messages received from the IdP. Note the IdP returning an "Authentication Failed" message for a valid user.

 <samlp:Status>
 <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder">
 <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:AuthnFailed"/>
 </samlp:StatusCode>
 <samlp:StatusMessage>Authentication Failed</samlp:StatusMessage>
 </samlp:Status>
</samlp:Response>

Environment

• DX NetOps Spectrum 21.2.x and higher (including 25.4.8)
• SAML 2.0 Integration

Cause

The Identity Provider is rejecting the authentication request for a specific user or group due to environmental factors, such as incorrect group memberships or expired internal credentials on the IdP side.

Resolution

Engage the IdP administrator for additional input. Do IdP logs show why the user is being rejected while others work fine?

With the error being limited to specific users, some things to check on the IdP are:

1. Review the logs on the Identity Provider (e.g., ADFS, PingFederate, OKTA) for the specific user attempting to log in.
2. Confirm the user belongs to the correct groups required for Spectrum access.
3. Ensure no time drift exists between the Spectrum server and the IdP server.