Issue
After configuring SAML SSO successfully, the user is unable to perform login and getting the following error in UI and Server console.
UI Error:
"Unable to process SAML request"
Server Console:
ERROR [http-nio-8080-exec-1][MandatoryAuthenticatedMessageRule:37] Inbound message issuer was not authenticated.
ERROR [http-nio-8080-exec-1][BaseSamlStrutsAction:58] org.opensaml.ws.security.SecurityPolicyException: Inbound message issuer was not authenticated.
Environment
- Liferay 7.1
Resolution
The above error will come when the response from the IDP is not signed wherein, Liferay allows authentication only when the response from IDP is signed.
-
Solution 1(Highly recommended):
Need to get the signed response from IDP to avoid the above error and to ensure successful authentication
-
Solution 2(Optional):
Achieving by customization through creating a plugin wherein it should bypass the signature verification in SAML.
Disclaimer: This may lead to a security issue
Additional Information
- If Liferay allows the authentication with an unsigned response from IDP, this may lead to a security issue wherein any MiM(Middle Men) could easily temper the response from the IdP and send it to the SP(Liferay) and since the response is not signed, SP will not be able to recognize whether the response is coming from IdP or from somewhere else.
- Ref: LPS-47700