000036125 - XML Parsing Error when attempting SP-initiated Single Sign-On with RSA SecurID Cloud Authentication Service

Document created by RSA Customer Support Employee on Mar 10, 2018
Version 1Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000036125
Applies ToRSA Product Set:  SecurID Access
RSA Product/Service Type: Cloud Authentication Service, Identity Router
IssueA SAML assertion unexpectedly contains no InResponseTo field and is rejected by the requesting Service Provider.

The IDR's /var/log/symplified.log contains errors similar to the example  below.

018-02-28/01:38:36.855/UTC [ajp-bio-8009-exec-8] WARN com.symplified.adapter.api.ApplianceAuthenticationConfig[289] - Problem casting Config Component to Boolean
...
2018-02-28/01:38:36.913/UTC [ajp-bio-8009-exec-8] ERROR net.shibboleth.utilities.java.support.xml.BasicParserPool[50] - XML Parsing Error
org.xml.sax.SAXParseException; lineNumber: 1; columnNumber: 1; Content is not allowed in prolog.
CauseThe SAML Binding Method (POST or Redirect) is configured inconsistently between the Service Provider (SP) and the Cloud Authentication Service's application configuration.
The IDR rejects the SAML authentication request and treats the scenario as IdP-initiated (thus no InResponseTo field).
 
ResolutionEnsure that the SAML binding method that the 3rd Party application (SP) is using (POST or Redirect) is also configured in the Administration Console Application -> My Applications -> Edit -> Connection Profile -> Binding Method for SAML Request.
NotesAlternatively, configuring the 3rd Party application as a Relying Party will not encounter this issue as incoming SAML requests are processed with either SAML binding method.
Reference the section on Relying Parties in the RSA SecurID Access Cloud Authentication Service documentation.
 

Attachments

    Outcomes