Troubleshooting: RSA Cryptography Error When Using SAML Signing with WindowsSSO

Version Affected: All
 
 

Overview

When using SAML assertion or message signing together with WindowsSSO, an RSA cryptography error appears, similar to:

System.Security.Cryptography.RSACryptoServiceProvider.GetKeyPair() ... at System.Security.Cryptography.X509Certificates.X509Certificate2.get_PrivateKey() at MFC.WebApp.SecureAuth.SAML20IdPInit.CreateSAMLResponse(String sUser, String UserID)

Cause

There can be several causes, generally related to a certificate issue:

• Missing permissions on the certificate's private key
• Loss of the private key
• The wrong certificate selected, or none selected

Resolution

Work through the following steps to narrow down the specific cause.

1. Confirm the error only happens with SAML assertion or message signing by temporarily setting Sign SAML Assertion and Sign SAML Message to False on the realm's Post Authentication tab, then check whether SAML works without them.
   
2. If the error still occurs, open the Certificates console (certlm.msc) and go to Personal > Certificates.
   
3. Right-click the certificate used for signing, then select All Tasks > Manage Private Keys.
   
4. Confirm Authenticated Users has at least Read access to the private key.
   
5. Once the permissions are correct, re-enable SAML assertion and message signing and test again.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.