Troubleshooting: SP-Initiated SAML Request Signature Validation Errors

Version Affected: All
 
 

Overview

This article explains how to resolve errors that occur when the IdP receives an SP-initiated SAML request: "Object reference not set to an instance of an object" and "Failed to receive authentication request by HTTP redirect." By default, the IdP does not validate the signature of the Service Provider's (SP) SSL certificate in a SAML request.

• See Cause 1 - If the ACS / SAMLRequest Certificate field on the Post Authentication tab is empty and the error log shows "SAML20SPInit exception error: Object reference not set to an instance of an object".
• See Cause 2 - If that field is already populated and the error log shows "SAML20SPInit exception error: Failed to receive authentication request by HTTP redirect."
• See Cause 3 - If that same error appears, but a tool like SAML Tracer shows the SAML request itself is not recognized as valid SAML, rather than a certificate or configuration mismatch.

These causes are not related, so a fix for one cause will not resolve the other cause.

 

In this article

• Cause 1: No Certificate Populated in the SAML Request Certificate Field
• Cause 2: Certificate Mismatch or Unsupported Configuration
• Cause 3: Malformed SAML Request

Cause 1: No Certificate Populated in the SAML Request Certificate Field

Signature validation requires a certificate in the ACS / SAMLRequest Certificate field, but nothing has been populated there.

Resolution 1:

To resolve this:

1. On the Post Authentication tab, paste the public key of the certificate the SP uses for signing into the ACS / SAMLRequest Certificate field.
   
2. To confirm the SP is sending a signature at all, capture a SAML trace.

Cause 2: Certificate Mismatch or Unsupported Configuration

IdP version 9.1 and earlier validates signatures only for realms configured as SP-Initiated by POST. IdP version 9.2 and later can also validate signatures for SP-Initiated by Redirect, subject to a minimum hotfix level (EE-1432). If the certificate populated in the ACS / SAMLRequest Certificate field does not match the certificate the SP actually used to sign the request, or the realm's configuration is not supported for validation, the error log shows the exception above.

Resolution 2:

To resolve this:

1. Confirm the public key in the ACS / SAMLRequest Certificate field (whether publicly issued or self-signed) matches the certificate the SP actually uses to sign the request.
2. If the realm uses SP-Initiated by Redirect, confirm the realm is running at least the minimum hotfix required to support it (EE-1432): 9.3.0-16 on IdP 9.3, or 19.07.01-8 on IdP 19.07.01.

Cause 3: Malformed SAML Request

The SAMLRequest itself is malformed, or has been altered - for example by extra encoding - somewhere between the SP and the IdP, independently of any certificate or hotfix issue.

Resolution 3:

To resolve this:

1. Capture a SAML trace and confirm the request is recognized as valid SAML. In tools like SAML Tracer, a valid SAML request is highlighted (for example, labeled "SAML" next to the request's URL) - if it is not recognized, the request itself is the problem, not the certificate.
2. If the SP is applying its own encoding to the request, try removing that encoding to see whether it's necessary.
3. Ask the SP whether anything else modifies the request before it's sent, and remove each modification one at a time to isolate the cause.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.