Troubleshooting: SAML Consumer Loops Back to the IdP Instead of Logging Into the Application

Version Affected: All
 
 

Overview

After authenticating, a SAML consumer loops back to the identity provider (IdP) and then back to the SAML consumer again instead of completing login to the application. A SAML tracer shows a cookie being created, but it disappears immediately.

Cause

The SAML consumer creates a cookie from the contents of the SAML assertion. Most browsers only allow a cookie to be up to 4096 bytes; if the assertion contains enough attributes to exceed this size once turned into a cookie, the browser silently discards the cookie right after it is created, which causes the loop.

Resolution:

Work with whoever manages the SecureAuth Identity Platform configuration to reduce the number of attributes included in the SAML assertion. Sending fewer attributes reduces the size of the resulting cookie and resolves the looping.


 

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.