Hi, I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

nileshr — Fri, 18 Dec 2015 10:23:45 GMT

It is expected only when we already have active session. I tried on different systems and cleared the browser cache as well but it is redirecting everytime on the IDP side. For the first time it should always open APPIAN login page which is not happening now.

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

Tom Ryan — Fri, 18 Dec 2015 07:02:45 GMT

If I understand the behavior correctly, this is expected unless you already have an active session with your IDP/SSO.

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

nileshr — Thu, 17 Dec 2015 17:32:08 GMT

Hi Tom,
When I tried to implement IDP initiated SSO, it is working fine. But the problem is that whenever I hit the url like "https://example.com/suite" in browser, it is redirecting me to IDP side everytime and login into APPIAN by validating the Username, instead it should open APPIAN login page, where I provided the link for "Login with SSO". To bypass SAML configuration we need to type "example.com/.../loginPage.none"
It was working fine till 7.10 in which after implementing SSO whenever we tried to access the url it is redirecting to APPIAN login page.
Is this a bug or the functionality in Appian 7.11 saml authentication?

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

Tom Ryan — Tue, 15 Dec 2015 04:38:25 GMT

It seems that either the response is missing or incomplete. Can you do a trace of the SAML request using either Fiddler or the SAML Tracer Addon for Firefox

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

nileshr — Mon, 14 Dec 2015 12:53:15 GMT

I have used the IDP metadata which contain only one <EntityDescriptor> tag. And it is giving me the same above error. Any suggestions on this.

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

Tom Ryan — Mon, 14 Dec 2015 04:34:04 GMT

Does your IDP metadata file contain multiple <EntityDescriptor> tags? This has been seen to cause similar issues in the past. If so, can you test with only using one?

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

nileshr — Fri, 11 Dec 2015 10:32:57 GMT

@Tom: I have tried to reproduce the issue again and made some changes but still facing the same issue. Below is the error from app-server.log:

DEBUG org.springframework.security.web.access.intercept.FilterSecurityInterceptor - Authorization successful
2015-12-09 13:24:30,913 [ajp-/0.0.0.0:8009-4] DEBUG org.springframework.security.web.access.intercept.FilterSecurityInterceptor - RunAsManager did not change Authentication object
2015-12-09 13:24:30,913 [ajp-/0.0.0.0:8009-4] DEBUG org.springframework.security.web.FilterChainProxy - /saml/AssertionConsumer at position 13 of 13 in additional filter chain; firing Filter: 'UserActivityFilter'
2015-12-09 13:24:30,914 [ajp-/0.0.0.0:8009-4] DEBUG org.springframework.security.web.FilterChainProxy - /saml/AssertionConsumer reached end of additional filter chain; proceeding with original chain
2015-12-09 13:24:30,914 [ajp-/0.0.0.0:8009-4] DEBUG org.springframework.security.web.util.matcher.AntPathRequestMatcher - Checking match of request : '/saml/assertionconsumer'; against '/api/**'
2015-12-09 13:24:30,915 [ajp-/0.0.0.0:8009-4] DEBUG org.springframework.security.web.util.matcher.AntPathRequestMatcher - Checking match of request : '/saml/assertionconsumer'; against '/saml/**'
2015-12-09 13:24:31,099 [ajp-/0.0.0.0:8009-4] ERROR com.appiancorp.security.auth.saml.SamlTestServlet - Unexpected exception during SAML authentication test
java.lang.IndexOutOfBoundsException: Index: 0
at java.util.Collections$EmptyList.get(Collections.java:4454)
at org.opensaml.xml.util.LazyList.get(LazyList.java:90)
at org.opensaml.xml.util.ListView.get(IndexedXMLObjectChildrenList.java:312)
at org.opensaml.xml.util.ListView.get(IndexedXMLObjectChildrenList.java:238)
at com.appiancorp.security.auth.saml.IdentityProviderManager.getName(IdentityProviderManager.java:133)
at com.appiancorp.security.auth.saml.IdentityProviderManager.createSamlAuthenticationToken(IdentityProviderManager.java:118)
at com.appiancorp.security.auth.saml.SamlTestServlet.handlePost(SamlTestServlet.java:102)
at com.appiancorp.security.auth.saml.SamlTestServlet.handleRequest(SamlTestServlet.java:76)
at com.appiancorp.security.auth.saml.SamlTestServlet.service(SamlTestServlet.java:61)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:847)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:295)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:214)
at com.appiancorp.ap2.EntryFilter.doFilter(EntryFilter.java:40)

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

Tom Ryan — Tue, 01 Dec 2015 02:50:22 GMT

Can you do the following:
1. Set the increased logging levels as I described in my previous note (if you didn't already)
2. Reproduce the issue then attach the latest app server log

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

nileshr — Mon, 30 Nov 2015 12:36:52 GMT

Hi Tom,
I am able to import the signed certificate in Admin console now. It was working fine on Appian 7.10. So I just migrated the SSO configuration to 7.11. AD server is the IDP.
But still I am getting the below error in application-server.log:
ERROR: com.appiancorp.security.auth.saml.SamlTestServlet - Unexpected exception during SAML authentication test
java.lang.IndexOutOfBoundsException : Index: 0
Please find the screenshot of SAML configuration in Admin console.
Could you please help me in resolving this?

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

Tom Ryan — Fri, 27 Nov 2015 02:33:04 GMT

You will need to look at the app server logs to see more details as to what is going wrong. If the logs don't show anything helpful, locate the following properties in <Appian Home>/ear/suite.ear/resources/appian_log4j.properties and set them as follows:

log4j.logger.com.appiancorp.security=DEBUG
log4j.logger.org.springframework.security=DEBUG

Then you should see some more detailed logs. If you still do not see anything helpful, check with your IDP to see whether they have anything logged on their side.

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

nileshr — Thu, 26 Nov 2015 17:18:44 GMT

Thanks Tom for your help. Now I am able to upload the self-signed certificate but still facing the issue while uploading signed CA certificate.I tried to test it using self-signed certificate and after uploading the Identity Provider Metadata file, when tried to login it is giving me error like "Authentication was unsuccessful.
Reason: Unexpected error occurred during SAML authentication test." Please find the screenshot for the error:

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

Tom Ryan — Tue, 24 Nov 2015 02:51:15 GMT

If you are referring to the sample one you attached, that is not a valid certificate.

You can try generating a new certificate/key pair by following steps like the ones here: stackoverflow.com/.../how-to-create-a-self-signed-certificate-with-openssl. You will need to combine the key and the cert into the same file.

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

nileshr — Mon, 23 Nov 2015 12:36:50 GMT

No, I don't see any issues related to this in app server log. Can you please try from your end, if you can able to import the certificate.

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

Tom Ryan — Mon, 23 Nov 2015 02:51:58 GMT

Are you seeing any more detailed errors in the app server log?

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

nileshr — Fri, 20 Nov 2015 10:39:58 GMT

@Tom I had provided the password in Service Provider Certificate Password field. But it is giving the error as soon as I upload the certificate.

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

Tom Ryan — Fri, 20 Nov 2015 07:57:56 GMT

Does the certificate require a password? If this is the case it will not import successfully until the password is supplied. Are you seeing any errors in the app server log?

Hi, I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App

RE: Hi,

I am trying to setup SAML Authentication via Admin Console in App