This article is a part of a wider topic, see parent page.
If you're using FlexNet Manager Suite Cloud, you can provide the Error IDs to Support.
If you are using FlexNet Manager Suite On-premise, you can enable debug-level logging and analyze the error logs yourself.
The WebUI log is accessible in %programdata%\Flexera Software\Compliance\Logging\WebUI\webui.log file.
Most authentication-related errors with SAML begin with a generic error message. The error log details are found at the end of the line. For example, see the full error below:
ManageSoft.Compliance.Security.Sso.SamlCoreException: There is problem while authenticating via SAML. Please make sure (a) that the web.config element 'kentor.authServices' is correctly configured, and (b) that the web server can connect to the configured SAML identity provider (if automatic metadata download is enabled). ---> System.Configuration.ConfigurationErrorsException: Unexpected entity id "https://sts.windows.net/xxx/" found when loading metadata for "https://sts.windows.net/yyy/".
at Kentor.AuthServices.IdentityProvider.ReadMetadata(ExtendedEntityDescriptor metadata)
at Kentor.AuthServices.IdentityProvider.DoLoadMetadata()
In the above log, the error log you will be interested in analyzing is:
System.Configuration.ConfigurationErrorsException: Unexpected entity id "https://sts.windows.net/xxx/" found when loading metadata for "https://sts.windows.net/xxx/"
at ...
User hello@flexera.com has no access rights in tenant
Resolution
EXEC dbo.GrantOperatorFullAccess 'hello@flexera.com'
Example log
System.IdentityModel.Tokens.AudienceUriValidationFailedException: ID1038: The AudienceRestrictionCondition was not valid because the specified Audience is not present in AudienceUris
Example log
System.NullReferenceException: Object reference not set to an instance of an object.
at Kentor.AuthServices.Configuration.ServiceCertificateCollection.InsertItem(Int32 index, ServiceCertificate item)
at Kentor.AuthServices.Configuration.ServiceCertificateElementCollection.RegisterServiceCertificates(SPOptions options)
<serviceCertificates>
<!-- Remove or comment the following: -->
<!-- <add fileName="" /> -->
</serviceCertificates>
Example log
System.Collections.Generic.KeyNotFoundException: No Idp with entity id "..." found. ---> System.Collections.Generic.KeyNotFoundException: The given key was not present in the dictionary.
at System.ThrowHelper.ThrowKeyNotFoundException()
OR
System.Configuration.ConfigurationErrorsException: Unexpected entity id "urn:internal:federation:xxx" found when loading metadata for "urn:federation:xxx"
Example log
Kentor.AuthServices.Exceptions.InvalidSignatureException: Message from https://okta.com/xxx failed signature verification
Example log
Kentor.AuthServices.Exceptions.InvalidSignatureException: Signature didn't verify. Have the contents been tampered with?
at Kentor.AuthServices.XmlHelpers.VerifySignature(IEnumerable`1 signingKeys, SignedXml signedXml, XmlElement signatureElement, Boolean validateCertificate)
at Kentor.AuthServices.XmlHelpers.IsSignedByAny(XmlElement xmlElement, IEnumerable`1 signingKeys, Boolean validateCertificate, String minimumSigningAlgorithm)
at Kentor.AuthServices.Saml2P.Saml2Response.ValidateSignature(IOptions options)
Example log
Kentor.AuthServices.Exceptions.InvalidSignatureException: The signature verified correctly with the key contained in the signature, but that key is not trusted.
Example log
System.Configuration.ConfigurationErrorsException: Idp "http://www.okta.com/xxx" is configured for signed AuthenticateRequests, but ServiceCertificates configuration contains no certificate with usage "Signing" or "Both". To resolve this issue you can a) add a service certificate with usage "Signing" or "Both" (default if not specified is "Both") or b) Set the AuthenticateRequestSigningBehavior configuration property to "Never".
Example log:
System.Security.Cryptography.CryptographicException: The system cannot find the file specified.
at System.Security.Cryptography.CryptographicException.ThrowCryptographicException(Int32 hr)
at System.Security.Cryptography.X509Certificates.X509Utils._QueryCertFileType(String fileName)
at System.Security.Cryptography.X509Certificates.X509Certificate.LoadCertificateFromFile(String fileName, Object password, X509KeyStorageFlags keyStorageFlags)
Example log:
System.InvalidOperationException: Finding cert through FindBySubjectName in LocalMachine:My with value flexnet.myorganization.com matched 2 certificates. A unique match is required.
Example log
Kentor.AuthServices.Exceptions.InvalidSignatureException: Cannot verify signature of message from unknown sender https://localhost:44300/Metadata
Example log
Kentor.AuthServices.Exceptions.UnsuccessfulSamlOperationException: Idp returned status "AuthnFailed", indicating that the single logout failed. The local session has been successfully terminated.
Example log
System.Security.Cryptography.CryptographicException: Invalid provider type specified.
Example log
Kentor.AuthServices.Exceptions.UnexpectedInResponseToException: Received message contains unexpected InResponseTo "id58c95ac8acce4ccd85826688510f5129". No cookie preserving state from the request was found so the message was not expected to have an InResponseTo attribute. This error typically occurs if the cookie set when doing SP-initiated sign on have been lost.
Example log
Unable to connect to the remote server ---> System.Net.Sockets.SocketException: No connection could be made because the target machine actively refused it 127.0.0.1:44300
...
at System.Net.WebClient.OpenRead(Uri address)
at Kentor.AuthServices.Metadata.MetadataLoader.Load(String metadataLocation)
OR
System.Net.WebException: The operation has timed out
at System.Net.WebClient.OpenRead(Uri address)
at Kentor.AuthServices.Metadata.MetadataLoader.Load(String metadataLocation)
Example log
Kentor.AuthServices.Exceptions.UnsuccessfulSamlOperationException: Received a LogoutResponse from http://localhost:44300/8a9c3d9f-3228-4d96-9c69-00000000/Metadata that cannot be processed because it is not signed.
Example log
Kentor.AuthServices.Exceptions.NoSamlResponseFoundException: No Saml2 Response found in the http request.
at Kentor.AuthServices.WebSso.AcsCommand.Run(HttpRequestData request, IOptions options)
Example log
ManageSoft.Compliance.Security.Sso.SamlCoreException: Invalid account: please enter a valid email address.
at Flexera.Web.Presentation.Security.SingleSignOnTenantSaml.ValidateIdentityUsername(String username)
Example log
Kentor.AuthServices.Exceptions.Saml2ResponseFailedValidationException: The SAML Response is not signed and contains unsigned Assertions. Response cannot be trusted.
at Kentor.AuthServices.Saml2P.Saml2Response.ValidateSignature(IOptions options)
<EntityDescriptor entityID="..." ...>
<IDPSSODescriptor WantAuthnRequestsSigned="false" ...>.../IDPSSODescriptor>
</EntityDescriptor>
Example log
System.ArgumentOutOfRangeException: Specified argument was out of the range of valid values.
Parameter name: validFrom
at System.IdentityModel.Tokens.SessionSecurityToken..ctor(ClaimsPrincipal claimsPrincipal, UniqueId contextId, String id, String context, Byte[] key, String endpointId, Nullable`1 validFrom, Nullable`1 validTo, UniqueId keyGeneration, Nullable`1 keyEffectiveTime, Nullable`1 keyExpirationTime, SctAuthorizationPolicy sctAuthorizationPolicy, Uri securityContextSecurityTokenWrapperSecureConversationVersion)
at System.IdentityModel.Tokens.SessionSecurityToken..ctor(ClaimsPrincipal claimsPrincipal, UniqueId contextId, String context, String endpointId, Nullable`1 validFrom, Nullable`1 validTo, SymmetricSecurityKey key)
at System.IdentityModel.Tokens.SessionSecurityToken..ctor(ClaimsPrincipal claimsPrincipal, String context, Nullable`1 validFrom, Nullable`1 validTo)
at Kentor.AuthServices.HttpModule.CommandResultHttpExtension.SignInOrOutSessionAuthenticationModule(CommandResult commandResult)
Resolution
This means that the certificate you configured in <serviceCertificates> section in web.config does not contain a private key to sign outgoing SAML requests from SP to the IdP.
Resolution
You can open the use developer tools in your browser and view the Networks tab while trying to log in via SAML. You may also need to check the Preserve Log option. Once you have done this, when performing SSO via SAML, you’ll be able to see all the HTTP requests happening in the background. These HTTP requests will contain the SAML requests and responses exchanged between the Idp and SP.
To make things simpler, you can use any SAML message decoder plugin of your choice to easily inspect the SAML requests/responses exchanged.
Some ideas on what to inspect:
Sample SAML requestSample SAML request
Sample SAML response
Information you may be interested in is highlighted in yellow below.
Sample SAML response
Important notes:
If you are a FlexNet Manager Suite administrator and want to test run the configuration prior to engaging with your IdP team, or you have been in back-and-forth discussions with your IdP team and the configuration just doesn't seem right, then using StubIdp might be the right choice for you.
{
"HideDetails": false,
"UserList": [
{
"DisplayName": "Admin User",
"Description": "A user who will be granted Administrator rights upon first login",
"Assertion": {
"NameId": "admin@myorganization.com",
"AttributeStatements": [
{
"Type": "FnmsAdmin",
"Value": "true"
}
]
}
}
],
"DefaultAssertionConsumerServiceUrl": "https://myorganization.flexera.com/Suite/AuthServices/Acs",
"DefaultAudience": "https://myorganization.flexera.com/Suite",
"IdpDescription": "FlexNet StubIdP - testing only"
}
<kentor.authServices entityId="https://flexnet.myorganization.com/Suite" returnUrl="https://flexnet.myorganization.com/Suite/AuthServices" authenticateRequestSigningBehavior="Never">
<identityProviders>
<add entityId="https://stubidp.sustainsys.com/1506e6c0-d2b0-49e8-919a-00000000000/Metadata" signOnUrl="https://stubidp.sustainsys.com/1506e6c0-d2b0-49e8-919a-00000000000" allowUnsolicitedAuthnResponse="true" binding="HttpRedirect" loadMetadata="true" metadataLocation="~/App_Data/metadata.xml">
<signingCertificate fileName="~/App_Data/stubidp.sustainsys.com.cer" />
</add>
</identityProviders>
<serviceCertificates>
<!-- Not needed in typical setup unless you want to configure SLO. -->
<!--<add storeName="My" storeLocation="LocalMachine" x509FindType="FindBySubjectName" findValue="flexnet.myorganization.com" use="Signing" />-->
</serviceCertificates>
</kentor.authServices>
on
Aug 07, 2020
03:00 AM
- edited on
Jun 13, 2024
03:50 PM
by
HollyM
@kent-au Thanks a lot for the detailed article , this very much useful and simpler to follow.
By the way, i was testing the SSO in one of my customer premise where i have observed that once the SAML authentication is started from the Okta, the site is just freezes at below URL.
https://xxx.oktapreview.com/app/xxx_flexnetmanagersuite_1/xxx/sso/saml
when checked in SAML tracer , it is stuck at the below step .
GET https://flexnet.myorganization.com/Suite/AuthServices
But when i reload the page, it is going to /suite .
Note : the mentioned issue is reported in new each login from Okta to FNMS .
Hi @emtmeta,
What SSO/recipient/destination URLs do you have configured in Okta? From what it sounds, there might be an issue with the redirect URL configured in Okta.
For Okta configuration guide, see https://community.flexera.com/t5/FlexNet-Manager-Knowledge-Base/FNMS-SAML-Setup-Okta-configuration-guide-to-enable-SSO-SAML-in/ta-p/157729
For WebUI side of the configuration, see https://community.flexera.com/t5/FlexNet-Manager-Knowledge-Base/FNMS-SAML-Setup-WebUI-configuration-guide-to-enable-SSO-SAML-in/ta-p/157804
Also, is the behavior you are describing consistent across different browsers and devices?
Cheers, Kent
Thanks a lot for the feedback.
I had a detailed troubleshooting and did some changed returnUrl in the web.config file as follows
Old Value : returnUrl="https://flexnet.myorganization.com/Suite/AuthServices"
New Value : returnUrl="https://flexnet.myorganization.com/Suite/"
When i removed authServices from the URL, the reported issue is no longer observed.
is this right practice ?
Regards,
Junaid Vengadan
Hi @emtmeta,
I can't say for certain but I remember seeing similar configuration for 'returnUrl' i.e. without /AuthServices. That should be completely fine as long as authentication flow works as expected for both IdP and SP initiated SSO.
Cheers, Kent