Submit Feedback
Legacy Knowledge Base
Published Jul. 2, 2025

SAML Authentication Issue: Message context was not authenticated when Azure AD as IDP

Written By

Sivakumar Perumal

How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!

While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.

Legacy Article

You are viewing an article from our legacy "FastTrack" publication program, made available for informational purposes. Articles in this program were published without a requirement for independent editing or verification and are provided"as is" without guarantee.

Before using any information from this article, independently verify its suitability for your situation and project.

Issue

  • After enabling the SAML, when the user is trying to log in, authentication failed with the following message.
     
    ERROR [http-nio-8080-exec-36][BaseSamlStrutsAction:59] org.opensaml.messaging.handler.MessageHandlerException: Message context was not authenticated
    Caused by: org.opensaml.messaging.handler.MessageHandlerException: Message context was not authenticated
    at org.opensaml.messaging.handler.impl.CheckMandatoryAuthentication.doInvoke(CheckMandatoryAuthentication.java:70)
    at org.opensaml.messaging.handler.AbstractMessageHandler.invoke(AbstractMessageHandler.java:95)
    at org.opensaml.messaging.handler.impl.BasicMessageHandlerChain.doInvoke(BasicMessageHandlerChain.java:87)
    at org.opensaml.messaging.handler.AbstractMessageHandler.invoke(AbstractMessageHandler.java:95)
    at com.liferay.saml.opensaml.integration.internal.servlet.profile.BaseProfile.decodeSamlMessage(BaseProfile.java:202)
    at com.liferay.saml.opensaml.integration.internal.servlet.profile.WebSsoProfileImpl.doProcessResponse(WebSsoProfileImpl.java:618)
    at com.liferay.saml.opensaml.integration.internal.servlet.profile.WebSsoProfileImpl.processResponse(WebSsoProfileImpl.java:198)

Environment

  • Liferay DXP 7.2 as Service Provider
  • Azure AD as IDP

Resolution

  • Liferay allows authentication only when the response from IDP is signed because the unsigned response from IDP could lead to security issues.
    • For example, any MiM (Middle Men) could easily tamper the response from the IdP and send it to the SP (Liferay).
  • I.e. if the response is not signed, the SP will not be able to recognize whether the response is coming from the respective configured IdP or from somewhere else, so the IdP must be configured to signed the responses (even if individual assertions are).
  • However, in Azure AD, the signing options and signing algorithm help to choose the signed response, by this way the response from IDP is signed.
Did this article resolve your issue ?
Legacy Knowledge Base
Did this article resolve your issue ?