SAML Authentication Issue: Message context was not authenticated

Issue

• After enabling the SAML, when the user is trying to log in, authentication failed with the following message.
  

  ERROR [http-nio-8080-exec-36][BaseSamlStrutsAction:59] org.opensaml.messaging.handler.MessageHandlerException: Message context was not authenticated
  Caused by: org.opensaml.messaging.handler.MessageHandlerException: Message context was not authenticated
  at org.opensaml.messaging.handler.impl.CheckMandatoryAuthentication.doInvoke(CheckMandatoryAuthentication.java:70)
  at org.opensaml.messaging.handler.AbstractMessageHandler.invoke(AbstractMessageHandler.java:95)
  at org.opensaml.messaging.handler.impl.BasicMessageHandlerChain.doInvoke(BasicMessageHandlerChain.java:87)
  at org.opensaml.messaging.handler.AbstractMessageHandler.invoke(AbstractMessageHandler.java:95)
  at com.liferay.saml.opensaml.integration.internal.servlet.profile.BaseProfile.decodeSamlMessage(BaseProfile.java:202)
  at com.liferay.saml.opensaml.integration.internal.servlet.profile.WebSsoProfileImpl.doProcessResponse(WebSsoProfileImpl.java:618)
  at com.liferay.saml.opensaml.integration.internal.servlet.profile.WebSsoProfileImpl.processResponse(WebSsoProfileImpl.java:198)

Environment

• Liferay DXP 7.2 as Service Provider

Resolution

• Liferay allows authentication only when the response from IDP is signed because the unsigned response from IDP could lead to security issue.
  • For example, any MiM (Middle Men) could easily tamper the response from the IdP and send it to the SP (Liferay).
    
• I.e. if the response is not signed, the SP will not be able to recognize whether the response is coming from the respective configured IdP or from somewhere else, so the IdP must be configured to signed the responses (even if individual assertions are).
  
• Both Response's and LogoutResponse's should be signed.

Additional Information

• Authenticating Using SAML - The SP Processes the SSO Response
  • The SP validates and processes the SAML Response. Liferay DXP’s SAML solution requires signed SAMLResponse messages.
• Setting up Liferay DXP as a SAML Service Provider
  • Note: If you have a third party IdP with Liferay DXP as the SP, all messages coming from the IdP must be signed. If they’re not, an error message appears and communication between the IdP and Liferay DXP fails.