Troubleshooting: SAML Consumer Rejects an Assertion With an Empty AttributeStatement Element

Version Affected: All
 
 

Overview

Some SAML Service Providers reject the SAML response outright when it contains an empty <saml:AttributeStatement /> element in the assertion.

Cause

An empty <saml:AttributeStatement /> element is sent when no claims are currently configured for the realm, but a static claim was configured at some point in the past — for example, if the realm was cloned from one that had a static claim set. Strict Service Providers can reject an assertion containing this empty element instead of simply ignoring it.

Resolution:

There are two workarounds:

1. Add a claim so the AttributeStatement element is not empty, or
2. Edit the realm's web.config and set ExtendedSAMLAttrCount to 0.

Steps for option 2:

• Take a copy of the realm's web.config before making changes.
• In the Admin Console, go to Advanced Settings.
• Click Tools | Decrypt web.config.
• Open the web.config and search for ExtendedSAMLAttrCount.
• Set the value to 0.
• Save the file and try again.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.