Zephyr SSO Authentication issue troubleshooting steps

July 19, 2018

We support SAML compliant SSO.

Make sure below details customer has to keep ready to configure Zephyr with SSO authentication. 

  • Identity provider URL ( This should point to their SSO login URL. When we click on Login via SSO button in the Zephyr login desktop, this click navigates to IDP URL. So please make sure that IDP URL they are entering should be able to access from the browser & that should navigate to their SSO login page)
  • Identity provider issuer ID ( This value is Entity ID in their SAML metadata)
  • SSO Certificate 

Users have to use the below as SSO & Audience URLs while performing SAML configuration at their end. 

  1. Single Sign-On URL:  <Zephyr_hostname>/flex/saml/sso
  2. Audience URL:  <Zephyr_hostname>/flex/saml/sso* This Audience URL allows our Zephyr instance to verify that is it the intended recipient of a SAML response.

How to handle below errors?

Error 1

2018-07-06 07:06:22,967 ERROR [http-nio-443-exec-4] SAMLResponseUtil.processSAMLResponse(144) | The assertion issuer didn't match the expected value

2018-07-06 07:07:31,531 ERROR [http-nio-443-exec-1] SAMLResponseUtil.processSAMLResponse(130) | org.opensaml.common.SAMLException: Issuer invalidated by issuer value http://COMPANY.COM/adfs/services/trust : http://company.com/adfs/services/trust

Handling:

Identity provider issuer id is case sensitive. So if you see above error in Zephyr log Check the issuer ID in their metadata & enter exactly the same value under  Identity provider issuer id box under Zephyr SSO configuration page.

Error 2

ERROR [http-nio-443-exec-5] SAMLResponseUtil.processSAMLResponse(150) | The NameID value is missing from the SAML response; this is likely an IDP configuration issue.

Handling:

For fixing the above error have changed below things:

  • Changed the attribute of NameID to the email address
  • Added the NameID to the SAML Subject

Error 3

ERROR [http-nio-443-exec-9] SAMLResponseUtil.getCredential(210) | java.security.cert.CertificateException: Could not parse certificate: java.io.IOException: Illegal header: -----BEGIN CERTIFICATE----- 

Handling:

Seems there are some additional space/characters added in the saved certificate, that results to above error.  Open the certificate file & re-save the file by removing unknown characters/space.

Notes

In Zephyr Cluster environment if they are configuring SSO authentication, make sure to have SSO certificate in both servers under the path Zephyr installation directory\zephyrdata\persist folder. If this certificate is in one server & not in another server you will get #35 error in the URL while logging via SSO.

Products:

Versions: 6.x