SAML no longer working after upgrading Liferay
How To articles are not official guidelines or officially supported documentation. They are community-contributed content and may not always reflect the latest updates to Liferay DXP. We welcome your feedback to improve How To articles!
While we make every effort to ensure this Knowledge Base is accurate, it may not always reflect the most recent updates or official guidelines.We appreciate your understanding and encourage you to reach out with any feedback or concerns.
Legacy Article
You are viewing an article from our legacy "FastTrack"
publication program, made available for informational purposes. Articles
in this program were published without a requirement for independent
editing or verification and are provided"as is" without
guarantee.
Before using any information from this article, independently verify its
suitability for your situation and project.
- In the Service Provider:
2020-09-15 21:54:32.833 ERROR [liferay/scheduler_dispatch-4][BasicParserPool:50] XML Parsing Error
org.xml.sax.SAXParseException; lineNumber: 37; columnNumber: 12; DOCTYPE is disallowed when the feature "http://apache.org/xml/features/disallow-doctype-decl" set to true.
at org.apache.xerces.util.ErrorHandlerWrapper.createSAXParseException(Unknown Source)
...
2020-09-15 21:54:32.836 WARN [liferay/scheduler_dispatch-4][SamlMetadataMessageListener:161] Unable to refresh IdP metadata for samlidp: Unable to parse metadata from http://samlidp:8080/c/portal/saml/metadata: Unable to parse inputstream, it contained invalid XML
15-Sep-2020 21:54:34.012 INFO [main] org.apache.catalina.startup.Catalina.start Server startup in [40,485] milliseconds
2020-09-15 21:54:34.365 ERROR [http-nio-9080-exec-1][BaseSamlStrutsAction:59] com.liferay.saml.runtime.SamlException: net.shibboleth.utilities.java.support.logic.ConstraintViolationException: Credential cannot be null
Environment
Resolution
-
When upgrading Liferay from one version to another, it is expected that the user will need to either move the SAML certificate that was generated in the old version to the new version, or refresh the SAML certificate in the new version. Otherwise, SAML will not work after going through the upgrade process. This is because when referencing those kinds of files, Liferay uses a path to the file that is relative to the Liferay installation, so it is looking for the file in the new bundle, not the old one.
- After either moving the SAML certificate from the old version of Liferay to the new one, or refreshing the SAML certificate in the new version, SAML should begin working again and the user will be able to authenticate.
- If you want to know where you keystore is located, check
LIFERAY_HOME/data/keystore.jks for FileSystem Keystore Manager or your Document Library directory for Document Library Keystore Manager (see Configure SAML).
Additional Information
Did this article resolve your issue ?