Federation Security Services Guide › Troubleshooting › URLs for Services at the Asserting Party › Consumer Not Authenticating When Accessing Assertion Retrieval Service

Consumer Not Authenticating When Accessing Assertion Retrieval Service

Symptom:

In an environment using SAML 1.x artifact single sign-on, the consumer fails authentication when trying to access the Assertion Retrieval Service at the producer.

Solution:

Depends upon the configured authentication:

• If Basic authentication is configured to protect the Assertion Retrieval Service, verify that the Name and Password values in the Affiliate configuration match the Affiliate Name and Password values configured for the SAML Artifact authentication scheme.
• If client certificate authentication is configured to protect the Assertion Retrieval Service, verify that the client certificate of the consumer is valid and that it is present in the AM.keystore database of the consumer. Additionally, verify that the certificate of the Certificate Authority that issued the client certificate is present in the web server key database at the producer.

Authentication Fails After Modifying Authentication Method

Symptom:

If you change the authentication method protecting the SAML 1.x Assertion Retrieval Service from Basic to Client Cert, subsequent authentication requests can fail.

If you change the authentication method protecting the SAML 1.x Assertion Retrieval Service from Client Cert to Basic, subsequent authentication requests can fail.

Solution:

Restart the web server after the authentication method is changed.

Client Authentication Fails for SAML Artifact Single Sign-on

Symptom:

Client certificate authentication for SAML 1.x artifact single sign-on fails at the producer. The following error is logged in the web agent trace logs:

Setting HTTP response variable HTTP_consumer_name=from SiteMinder

For example, if the Attribute Name in the response is configured as "name" for an LDAP User Directory, the response fails.

Solution:

Verify that you create a Web Agent response under the domain FederationWebServicesDomain. The response must be as follows:

Attribute type

WebAgent HTTP Header variable

Attribute Kind

User Attribute

Variable Name

consumer_name

Attribute Name

uid (for LDAP) or name (for ODBC)

SAML 2.0-Only Issues

The following issues apply only to SAML 2.0 features.