Troubleshooting: IdP-Initiated SAML Fails When Launched via a Portal Realm

Version Affected: All
 
 

Overview

Launching an Identity Provider (IdP)-initiated SAML application through a portal realm can fail with the error shown below, even though logging into the SAML realm directly works without issue.

This error has two possible causes:

• See Cause 1 - Launching the SAML app through a SecurePortal realm shows this error immediately
• See Cause 2 - Launching the SAML app through a WindowsSSO portal realm shows this error only after logging out of a SAML realm

These causes are not related, so a fix for one will not resolve the other.

 

In this article

• Cause 1: Get Shared Secret and Set Shared Secret values do not match
• Cause 2: The PostAuth cookie is deleted after logout

Cause 1: Get Shared Secret and Set Shared Secret values do not match

The Get Shared Secret and Set Shared Secret values do not match between the SecurePortal realm and the SAML realm.

Resolution 1:

To resolve this:

1. Open the Admin Console and go to the SecurePortal realm’s Workflow tab.
2. Scroll to the Custom Identity Consumer section and note the Get Shared Secret and Set Shared Secret values, as shown below.

3. Go to the Workflow tab of the SAML realm.
4. Set that realm’s Get Shared Secret and Set Shared Secret values to match the SecurePortal realm’s values from the previous step.
5. Click Save.

Cause 2: The PostAuth cookie is deleted after logout

A WindowsSSO portal realm sends users directly to /Authorized/Saml20IdPInit.aspx, which requires a valid PostAuth token even though WindowsSSO is the authentication method. This works until the user logs out of a SAML realm by calling Logout.aspx, which deletes the PostAuth cookie. After that, launching any IdP-initiated SAML application fails with the error above, until the portal page is reopened to regenerate the cookie.

Resolution 2:

Set SPStartURL on the Post Auth tab of the IdP-initiated realm to the realm's own address. SPStartURL is normally used for SP-initiated SAML, but when it is present, the portal uses that address instead -- pointing it at the WindowsSSO begin site for the IdP-initiated realm recreates the PostAuth cookie.

1. Open the Web Admin Console.
2. Go to the Post Auth tab of the IdP-initiated realm.
3. Set SPStartURL to the address of the realm itself -- for example, if the realm is secureauth85, set it to https://your-idp-server.com/secureauth85.
4. Click Save.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.