SAML Authentication on DLP Enforce Console Fails Post-Upgrade to 26.1

Products

• Data Loss Prevention

Issue/Introduction

After upgrading to Symantec Data Loss Prevention (DLP) 26.1, SAML authentication via ADFS fails, preventing users from logging into the DLP Enforce Console. The ADFS server rejects the login request because it expects a signed authentication request but receives an unsigned one.

Source: com.vontu.config.manager.ManagerSpringSecurityConfig
Message: SAML authentication failed with exception: org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationException - Invalid status [urn:oasis:names:tc:SAML:2.0:status:Responder] for SAML response 1eab5845-28dc-4d79-b168-753e7#######

Below Event id is seen on the ADFS server after upgrade of 26.1

Event id:364 
Exception details:
Microsoft.IdentityServer.Protocols.Saml.SamlProtocolSignatureVerificationException: MSIS7086: The relying party trust https://example.com/ProtectManager/saml/metadata' indicates that authentication requests sent by this relying party will be signed but no signature is present. Microsoft.IdentityServer.Web.Protocols.Saml.SamlProtocolManager.ValidateSignatureRequirements (SamlMessage samlMessage)

Environment

 

• Symantec Data Loss Prevention (DLP) version 26.1

• ADFS SAML Authentication

 

 

Cause

In Symantec DLP 26.1, the system introduced full support for SAML 2.0.
If the WantAuthnRequestsSigned setting is missing from the ADFS metadata file, DLP interprets this absence as False and proceeds to send an unsigned authentication request, which is then rejected by the ADFS server.

Resolution

To resolve this issue, you must complete both of the following requirements: Ensure the ADFS metadata is configured to want signed requests, and provide the Enforce signing certificate to the IDP.

Part A: Update ADFS Metadata

A] 26.1 requires an additional step to export the certificate and provide it to IDP 

1]Create a keystore with a signing certificate.
Note: If samlKeystore.jks already exists, skip to step 3.

keytool -genkeypair -alias <your_alias> -keyalg RSA -keysize 2048 -keystore samlKeystore.jks -storepass <store_password> -keypass <key_password> -dname "CN=<dlp-server.domain.com>,OU=<OU>,O=<Company>,L=<City>,ST=<State>,C=<Country>" -validity 3650

2]Configure keystore properties:
Update the following properties in your configuration file:

com.vontu.manager.authentication.saml.keystoreLocation = ../tomcat/webapps/ProtectManager/security/samlKeystore.jks
com.vontu.manager.authentication.saml.keystorePassword =protect
com.vontu.manager.authentication.saml.keystoreAlias = enforce
com.vontu.manager.authentication.saml.keystore.keyPassword = protect

Part B Export certificate and provide to IDP:

3]keytool -exportcert -alias enforce -keystore samlKeystore.jks -storepass protect -file dlp-sp-cert.cer

B] Export a fresh copy of idp-metadata.xml from ADFS, ensure WantAuthnRequestsSigned="true" is populated under <IDPSSODescriptor> tag and replace it under <installdirectory>/Protect/tomcat/webapps/ProtectManager/security/idp-metadata.xml

If the metadata cannot be fixed using the required resolution above, you can follow one of these workarounds:

Option 1: Revert to Pre-Upgrade SAML 1 Settings

Stop the DLP Manager Services

1.Navigate to <installation folder>\EnforceServer\26.1.00000\Protect\config\.
Make a backup copy of manager.properties (save as manager.properties.bak).
In the active manager.properties file, set the following properties to be blank (leave them empty after the = sign):

     com.vontu.manager.authentication.saml.keystoreLocation = 
     com.vontu.manager.authentication.saml.keystorePassword = 
     com.vontu.manager.authentication.saml.keystoreAlias = 
     com.vontu.manager.authentication.saml.keystore.keyPassword =

Save the file

Restart the DLP Manager Service.

2. Export the  Metadata from DLP

• Log in to the Symantec DLP Enforce Web Console.

• Navigate to System > Settings > General.

• Scroll down to the SAML Authentication section.

•  Download Metadata from Enforce indicate  AuthnRequestsSigned="false" shows false before providing it to the ADFS Administrator. 

3. Provide this newly generated XML file to the ADFS Administrator and ask them to update it in the ADFS. 

Option 2: Contact Support
Contact Support to obtain the settings to ignore the WantAuthnRequestsSigned setting in the metadata file.