Troubleshooting: Service Provider Delay When Attempting SAML Artifact Binding

Version Affected: 9.2 and higher
 
 

Overview

When a realm's SAML metadata has been shared with a Service Provider (SP), some SPs attempt SAML Artifact Binding instead of HTTP POST Binding or HTTP Redirect Binding. This typically causes a delay while the SP times out waiting for a response.

Cause

The metadata shared by the realm includes an AttributeAuthorityDescriptor element with a SOAP binding. SecureAuth IdP does not currently support SAML over SOAP, so the SP's attempt to use that binding stalls rather than failing immediately.

Resolution:

Edit the metadata XML before sharing it with the SP, and remove the entire AttributeAuthorityDescriptor element, including everything nested inside its opening and closing tags. For example, remove a section shaped like:

<AttributeAuthorityDescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
  <AttributeService Binding="urn:oasis:names:tc:SAML:2.0:bindings:SOAP" Location="..." />
  ...
</AttributeAuthorityDescriptor>

Once the AttributeAuthorityDescriptor element is removed, share the edited metadata with the SP.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.