Hi team, We recently planned to migrate the IDP configuration from one to another. During this migration, we did not delete the old IDP (IDP1) but added a new one (IDP2). However, when testing the new IDP (IDP2), we encountered a 401 error. Remarks: I have accounts in both IDPs with similar Email IDs. The first IDP (IDP1) works properly. When testing IDP2, the SAML response shows success ( <samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status> ), but we are receiving a 401 response. where i find the SMAL responce logs in appian In Idp2 responce we recevied name id and attribute(email) was different but we are using email id as AttributeValue of Username in appian Could you please assist in resolving this issue with IDP2? Thank you.

SMAL

purnavenkatasatyavaraprasadt0001

Certified Associate Developer

5 months ago

Hi team,

We recently planned to migrate the IDP configuration from one to another. During this migration, we did not delete the old IDP (IDP1) but added a new one (IDP2). However, when testing the new IDP (IDP2), we encountered a 401 error.

Remarks:

I have accounts in both IDPs with similar Email IDs.
The first IDP (IDP1) works properly.
When testing IDP2, the SAML response shows success (<samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status>), but we are receiving a 401 response.
where i find the SMAL responce logs in appian
In Idp2 responce we recevied name id and attribute(email) was different but we are using email id as AttributeValue of Username in appian

Could you please assist in resolving this issue with IDP2?

Thank you.

Discussion posts and replies are publicly visible

Parents

0 David Jimenez Calleja
Certified Lead Developer
5 months ago

Install saml extension in your browser, and you will be able to compare both requests, in order to check where is the error.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 purnavenkatasatyavaraprasadt0001
Certified Associate Developer
5 months ago in reply to David Jimenez Calleja

Hi david why i am not seen the Signature hashing Hashing Algorithm option in smal configuration is there any problem with configuration
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 David Jimenez Calleja
Certified Lead Developer
4 months ago in reply to purnavenkatasatyavaraprasadt0001

I do not understand...... First of all, I would try to find where the error is located.. (using SAML Tools).
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 purnavenkatasatyavaraprasadt0001
Certified Associate Developer
4 months ago in reply to David Jimenez Calleja
Hi David

I observed a few differences between Idp1 and idp2 login and also have some Questions

Idp1 SAML Response contains the following lines and it's working fine

<AuthnContext>

        <AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</AuthnContextClassRef>

      </AuthnContext>

While IDP2 had it like this we geting 401 error in the interface

       <AuthnContext>

           <AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Unspecified</AuthnContextClassRef>

      </AuthnContext>

Could this be an issue?

Our generated Metadata file which we provided might have changed a little in terms of <md:RequestedAttribute> even if I guess that doesn’t matter, could that be a reason that it can’t authenticate?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 purnavenkatasatyavaraprasadt0001
Certified Associate Developer
4 months ago in reply to David Jimenez Calleja
Hi David

I observed a few differences between Idp1 and idp2 login and also have some Questions

Idp1 SAML Response contains the following lines and it's working fine

<AuthnContext>

        <AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</AuthnContextClassRef>

      </AuthnContext>

While IDP2 had it like this we geting 401 error in the interface

       <AuthnContext>

           <AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Unspecified</AuthnContextClassRef>

      </AuthnContext>

Could this be an issue?

Our generated Metadata file which we provided might have changed a little in terms of <md:RequestedAttribute> even if I guess that doesn’t matter, could that be a reason that it can’t authenticate?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 David Jimenez Calleja
Certified Lead Developer
4 months ago in reply to purnavenkatasatyavaraprasadt0001

The only differences between responses is only that line?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel