Invalid SAML Response error

Question

Invalid SAML Response error

LYassine 21

Hi,

I have tried everything I have found on the internet to solve this issue but I still have this error when the federated IDP I'm working on redirects back to Azure. Could you help please ? I only need more details about the issue but I can't find it in the logs on AzureAD:

Request Id: ce463b12-9e07-4eb0-8923-4d83bd703400
Correlation Id: 3ad6e58e-c430-4ffd-a77b-dc293489d186
Timestamp: 2022-03-09T16:57:38Z
Message: AADSTS500089: SAML 2.0 assertion validation failed: SAML token is invalid.

Thank you

Siva-kumar-selvaraj 15,741 Reputation points Volunteer Moderator

2022-04-04T19:51:14.537+00:00

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Answer accepted by question author

0 additional answers

Your answer

Siva-kumar-selvaraj 15,741 Reputation points Volunteer Moderator

2022-04-04T19:51:14.537+00:00

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.

Answer 1

@LYassine , Thanks for reaching out and apologies for the delay in response.

By tracking the details from the backend for your tenant based on the correlation ID and the timeframe of the error you have provided, I see some exception related to date and time of issued token as you could see below, an issued token was just valid for 2 minutes from issinst:2022-03-09T16:57:34Z to naf:2022-03-09T16:59:34Z which I feel very short duration so wondering any specific reason why your IDP sent token with shorter duration ? Ideally SAML token validity is 1 hour with Azure AD scenario.

ValidateSamlToken failed. Assertion: {"iss":"https://localhost:6500","issinst":"2022-03-09T16:57:34Z","naf":"2022-03-09T16:59:34Z","aud":["urn:federation:MicrosoftOnline"]}

Additionally, I would request you to ensure if identity provider is sending proper values in the following fields in the token IssueInstant , NotBefore , NotOnOrAfter , saml:Audience as urn:federation:MicrosoftOnline and, make sure identity provider is using the right key algorithm for signing token like RSA. Here's sample-token.xml for reference which you can use to compare non-working token. For detailed information about compatibility, see Azure AD federation compatibility list and Azure AD identity provider compatibility docs when using custom IDP for SSO.

Hope this helps.

Share via

Invalid SAML Response error

0 additional answers

Your answer