SAML authentication with PASOE fails with error: "Response doesn't have any valid assertion which would pass subject validation""

This article discusses how to address errors "Response doesn't have any valid assertion which would pass subject validation" and "Authentication statement is too old to be used with value <date/time>" when authenticating to PASOE using SAML authentication.

Sep 26, 2019
Knowledge

Title

URL Name

SAML-authentication-with-PASOE-fails-with-error-Response-doesn-t-have-any-valid-assertion-which-would-pass-subject-validation

Article Number

000113651

Environment

Product: OpenEdge Version: 11.7.5 and later, 12.x OS: Windows Other: Microsoft Active Directory Federation Services (AD FS), SAML

Question/Problem Description

SAML authentication with PASOE fails with error:

Error validating SAML message : Response doesn't have any valid assertion which would pass subject validation.

The error occurs more than 2 hours after the user last logged in to the Identity Provider (eg AD FS).

Steps to Reproduce

Clarifying Information

Configured the PASOE ABL Web Application with the SAML authentication model.

Error Message

debug log default.<date>.log reads: ERROR c.p.a.s.s.OESamlAuthenticationProvider - Error validating SAML message : Response doesn't have any valid assertion which would pass subject validation After enabling debug logging on class com.progress.appserv.services.security.OESamlWebssoProfileConsumerImpl, debug log default.<date>.log reads: DEBUG c.p.a.s.s.OESamlWebssoProfileConsumerImpl - Validation of authentication statement in assertion failed, skipping org.springframework.security.authentication.CredentialsExpiredException: Authentication statement is too old to be used with value <date/time> at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.verifyAuthenticationStatement(WebSSOProfileConsumerImpl.java:538) at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.verifyAssertion(WebSSOProfileConsumerImpl.java:308) at org.springframework.security.saml.websso.WebSSOProfileConsumerImpl.processAuthenticationResponse(WebSSOProfileConsumerImpl.java:214) at com.progress.appserv.services.security.OESamlAuthenticationProvider.authenticate(OESamlAuthenticationProvider.java:73) at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:174) at com.progress.appserv.services.security.OESamlWebSSOProcessingFilter.validateSAMLToken(OESamlWebSSOProcessingFilter.java:159) at com.progress.appserv.services.security.OESamlWebSSOProcessingFilter.attemptAuthentication(OESamlWebSSOProcessingFilter.java:120) at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:212) at com.progress.appserv.services.security.OESamlWebSSOProcessingFilter.doFilter(OESamlWebSSOProcessingFilter.java:108)

Defect Number

Defect ADAS-20297

Enhancement Number

Cause

The CredentialsExpiredException indicates that time when user authenticated to the Identity Provider (IdP) has expired.

For security reasons system limits the time window enabling processing of SAML messages and assertions.
System allows users to single sign-on for up to 7200 seconds (2 hours) since their initial authentication with the IDP.

This time typically differs from the time the SAML assertion was created, meaning authentication can fail with that exception before the SAML response assertion expires.

The time when the user authenticated to the IDP is indicated in the SAML response with the response.assertion.authnStatement.authnInstant entity.

The SAML response assertion expiration date/time is indicated in the SAML response with the response.assertion.condition.notOnOrAfter entity.

If the client tries to authenticate at a time where response.assertion.authnStatement.authnInstant < client authentication time < response.assertion.condition.notOnOrAfter then the above exception will occur.

Some IDPs allow users to stay authenticated for longer periods than 2 hours and you might need to change the default value of 7200 seconds by setting maxAuthenticationAge of the OESamlWebSSOProfileConsumerImpl bean.

Resolution

oeablsecurity.properties has no property to define maxAuthenticationAge, which allows for the adjustement of the time elapsed between the sign-on time and the initial authentication with the IdP before the system returns a CredentialsExpiredException. Until the key information can be configured in oeablsecurity.properties, use the workaround below.

Workaround

From your Web Application root folder, edit WEB-INF\spring\samlAuthManager.xml

Locate the following line:

<b:bean id="webSSOprofileConsumer" class="com.progress.appserv.services.security.OESamlWebssoProfileConsumerImpl"/>

and replace it with:

<b:bean id="webSSOprofileConsumer" class="com.progress.appserv.services.security.OESamlWebssoProfileConsumerImpl">
<b:property name="maxAuthenticationAge" value="43200"/>
</b:bean>

Here maxAuthenticationAge is set to 43200 seconds (12 hours).
Adjust the value at your convenience, for instance to the duration of a typical business day.

Notes

Progress Article(s):

How to configure PAS debug logging in OpenEdge 12.0?

References to Other Documentation:

“10. Advanced Configuration.” Spring Security SAML Extension - Reference Documentation, docs.spring.io/spring-security-saml/docs/current/reference/html/configuration-advanced.html.

Keyword Phrase

Last Modified Date

11/20/2020 6:59 AM

SAML authentication with PASOE fails with error: "Response doesn't have any valid assertion which would pass subject validation""

Files(0)

Was this article helpful?

Was this article helpful?

SAML authentication with PASOE fails with error: "Response doesn't have any valid assertion which would pass subject validation""

Information

Related Articles