Error : Error Signing Assertion and 403 Forbidden in SAML Applications
Article ID: 7886
Updated On:
Products
Issue/Introduction
Trying to access the SAML application URLs for an IdP-initiated transaction.
The error displayed on the browser is a 403 Forbidden error and the Policy Server reports:
smps.log:
[31839/3992509296][Tue Jul 25 2017 13:03:16][AssertionGenerator.java][ERROR][sm-FedServer-00130] postProcess() returns fatal error. <Response ID="_9068337c7b67a02d32f299d8358f112a23dc" IssueInstant="2017-07-25T13:03:16Z" Version="2.0" xmlns="urn:oasis:names:tc:SAML:2.0:protocol">
<ns1:Issuer Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity" xmlns:ns1="urn:oasis:names:tc:SAML:2.0:assertion">http://idp.example.com/app/portal</ns1:Issuer>
<Status><StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder"/><StatusMessage>Error Signing Assertion.</StatusMessage></Status></Response>
Environment
Policy Server 12.8.x
Web Agent 12.52.x
Web Agent Option Pack 12.52.x
SAML 2.0
Cause
The keys that were used to sign the assertion were corrupted.
To check the certificate validity:
- In the AdminUI, going to Federation / Partnership Federation / Partnerships. Click on the Actions / View on the Partnership.
- Scroll down to the Signature section, and verify that all "Expires on" dates are in the future, and they all marked with a green dot.
- On the Policy Server, try to export the certificate to ensure it is fully usable.
# smkeytool.sh -export -alias <alias> -outfile <output-filename> -v# openssl x509 -in <output-filename> -text -noout
The openssl command should report no error. Verify the dates for the certificate and its signature are in the future.
Resolution
Importing new functional private keys into CDS (Certificate Data Store) resolved the issue (1).
If there's a problem to update or remove the primary certificate, set the new certificate as "Secondary Signing Private Key Alias" and the "Secondary Verification Certificate Alias" (2)(3).
Additional Information
Feedback
