Having problems with SAML auth on IdP version 4.1.3

[Duncan Sinclair]

Hi Folks,

A few weeks back I switched our Shibboleth IdP to authenticate using AzureAD, using the new feature in IdP 4, and the excellent guide by Chris Phillips.

Unfortunately I soon started getting reports of the "back button" error appearing occasionally for some people (I only ever managed to get it to happen once.)

I couldn't understand what the problem was - I guessed it might be something to do with "SameSite" cookies, and switched over to HTML Local Storage, but that didn't solve it.

Then I noticed that 4.1.3 had been released with a fix for AzureAD authentication.

So, now I'm trying to upgrade to 4.1.3, but I've run into problems. Basically, Shibboleth isn't liking the reply from AzureAD any more - ever.

Here's some debug output.

Can anybody help?

Cheers,


Duncan Sinclair.

====
2021-07-27 10:08:32,860 - xx.xx.xx.xx - DEBUG [org.opensaml.saml.saml2.assertion.impl.AbstractSubjectConfirmationValidator:260] - Evaluating SubjectConfirmationData at InResponseTo of: _ee1dd7d447190c46d68f445618ec0846
2021-07-27 10:08:32,860 - xx.xx.xx.xx - DEBUG [org.opensaml.saml.saml2.assertion.impl.AbstractSubjectConfirmationValidator:285] - Failed to match SubjectConfirmationData at InResponse to the valid value: _693f7aa9561bcb61cee414bc160f1746
2021-07-27 10:08:32,861 - xx.xx.xx.xx - DEBUG [org.opensaml.saml.saml2.assertion.SAML20AssertionValidator:786] - No subject confirmation methods were met for assertion with ID '_c4faa3df-4f36-4369-94ba-b10fa8d85c00'
2021-07-27 10:08:32,861 - xx.xx.xx.xx - DEBUG [org.opensaml.saml.saml2.profile.impl.ValidateAssertions:329] - Profile Action ValidateAssertions: Assertion validation result was: INVALID
2021-07-27 10:08:32,861 - xx.xx.xx.xx - INFO [org.opensaml.saml.saml2.profile.impl.ValidateAssertions:331] - Profile Action ValidateAssertions: Assertion validation failure msg was: No subject confirmation methods were met for assertion with ID '_c4faa3df-4f36-4369-94ba-b10fa8d85c00'
2021-07-27 10:08:32,871 - xx.xx.xx.xx - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ProcessAssertionsForAuthentication:217] - Profile Action ProcessAssertionsForAuthentication: Removing 1 non-valid Assertions from Response
2021-07-27 10:08:32,875 - xx.xx.xx.xx - INFO [net.shibboleth.idp.saml.saml2.profile.impl.ProcessAssertionsForAuthentication:228] - Profile Action ProcessAssertionsForAuthentication: No valid SAML Assertions suitable for authentication were found
====

--
Duncan Sinclair
Infrastructure Specialist - Systems
Abertay University, Dundee

[Abertay Named UK University of the Year for Teaching Quality]<https://abertay.co/ZTQw>

Abertay University is a charity registered in Scotland, No. SC016040

Follow us: www.abertay.ac.uk<http://www.abertay.ac.uk> | @AbertayUni<https://twitter.com/AbertayUni> | AbertayLinkedIn<https://www.linkedin.com/edu/school?id=12685> | AbertayFacebook<https://www.facebook.com/AbertayUni>

Any views or opinions expressed in this email and any attachments are solely those of the author and do not necessarily represent those of Abertay University. This email and any attachments may be confidential and are intended solely for the use of the intended recipient. If you are not the intended recipient, you must take no action based on the email or its attachments, nor must you copy or show them to anyone. Please contact the sender if you believe you have received this email in error.